Vulnerability · Published Jun 25, 2024 · Assigned by GitHub_M

CVE-2024-38364DSpace Cross Site Scripting (XSS) via a deposited HTML/XML document

Low 2.6

In plain English

A low-severity cross-site scripting in DSpace from DSpace. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 34% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)2.6Low

Exploit odds (30 days)0.4%top 66.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

DSpace is an open source software is a turnkey repository application used by more than 2,000 organizations and institutions worldwide to provide durable access to digital resources. In DSpace 7.0 through 7.6.1, when an HTML, XML or JavaScript Bitstream is downloaded, the user's browser may execute any embedded JavaScript. If that embedded JavaScript is malicious, there is a risk of an XSS attack. This vulnerability has been patched in version 7.6.2.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Maven	org.dspace:dspace-server-webapp	7.6.2	GHSA-94cc-xjxr-pwvf

Affected products (as reported)

Vendor	Product	Versions
DSpace	DSpace	>= 7.0, < 7.6.2

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:L

References

https://github.com/DSpace/DSpace/security/advisories/GHSA-94cc-xjxr-pwvf x_refsource_CONFIRM
https://github.com/DSpace/DSpace/pull/8891 x_refsource_MISC
https://github.com/DSpace/DSpace/pull/9638 x_refsource_MISC
https://github.com/DSpace/DSpace/commit/f1059b4340857cca3dc4c45b1ebbadce6bb61c0b x_refsource_MISC