Vulnerability · Published Aug 1, 2022 · Assigned by GitHub_M
CVE-2022-31189"Internal System Error" page in DSpace JSPUI prints exceptions and stack traces without sanitization
Medium 5.3
In plain English
A medium-severity security flaw in DSpace from DSpace. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 54% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
DSpace open source software is a repository application which provides durable access to digital resources. dspace-jspui is a UI component for DSpace. When an "Internal System Error" occurs in the JSPUI, then entire exception (including stack trace) is available. Information in this stacktrace may be useful to an attacker in launching a more sophisticated attack. This vulnerability only impacts the JSPUI. This issue has been fixed in version 6.4. users are advised to upgrade. Users unable to upgrade should disable the display of error messages in their internal.jsp file.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | org.dspace:dspace-jspui | 6.4 | GHSA-c2j7-66m3-r4ff |
Affected products (as reported)
Weakness: CWE-209 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N