Log in Start free

Vulnerability · Published Oct 29, 2021 · Assigned by GitHub_M

CVE-2021-41189Communities and collections administrators can escalate their privilege up to system administrator

High 7.2

In plain English

A high-severity incorrect authorization in DSpace from DSpace. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.1% (higher than 81% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.2High
Exploit odds (30 days)2.1%top 18.6% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

DSpace is an open source turnkey repository application. In version 7.0, any community or collection administrator can escalate their permission up to become system administrator. This vulnerability only exists in 7.0 and does not impact 6.x or below. This issue is patched in version 7.1. As a workaround, users of 7.0 may temporarily disable the ability for community or collection administrators to manage permissions or workflows settings.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Mavenorg.dspace:dspace-api7.1GHSA-cf2j-vf36-c6w8

Affected products (as reported)

VendorProductVersions
DSpace DSpace >= 7.0, < 7.1

Weakness: CWE-863 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

References