CVE-2022-31194

🗓️ 01 Aug 2022 20:25:26Reported by GitHub_MType

cve🔗 web.nvd.nist.gov📰️ 4 Media mentions👁 143 Views🌐 WEB

DSpace open source software DSpace-jspui UI component is vulnerable to path traversal attacks allowing creation of files/directories on the server writable by the Tomcat/DSpace user via request parameter modification

Reporter	Title	Published	Views	Family All 20
Circl	CVE-2022-31194	2 Aug 202200:17	–	circl
CNNVD	DSpace path traversal vulnerability	1 Aug 202200:00	–	cnnvd
Cvelist	CVE-2022-31194 Path traversal vulnerabilities in DSpace JSPUI submission upload	1 Aug 202220:25	–	cvelist
EUVD	EUVD-2022-6608	3 Oct 202520:07	–	euvd
Github Security Blog	JSPUI vulnerable to path traversal in submission (resumable) upload	6 Aug 202205:47	–	github
Kitploit	DSpace__DSpace_CVE-2022-31194_5-10	30 Oct 202616:58	–	kitploit
Mend	CVE-2022-31194	1 Aug 202220:25	–	mend
NVD	CVE-2022-31194	1 Aug 202221:15	–	nvd
osv_ghsa	GHSA-QP5M-C3M9-8Q2P JSPUI vulnerable to path traversal in submission (resumable) upload	6 Aug 202205:47	–	osv_ghsa
Prion	Path traversal	1 Aug 202221:15	–	prion

NVD

Vulners

Node

duraspace dspaceRange4.0–5.10

duraspace dspaceRange6.0–6.4

[
  {
    "product": "DSpace",
    "vendor": "DSpace",
    "versions": [
      {
        "status": "affected",
        "version": ">= 6.0, < 6.4"
      },
      {
        "status": "affected",
        "version": ">= 4.0, < 5.11"
      }
    ]
  }
]

Source	Link
github	www.github.com/DSpace/DSpace/security/advisories/GHSA-qp5m-c3m9-8q2p
github	www.github.com/DSpace/DSpace/commit/7569c6374aefeafb996e202cf8d631020eda5f24
github	www.github.com/DSpace/DSpace/commit/d1dd7d23329ef055069759df15cfa200c8e3

Parameter	Position	Path	Description	CWE
SubmissionController	request body	/dspace/submit	Path traversal in the resumable upload implementation allows a user with submitter privileges to create files/directories anywhere on the server.	CWE-22
FileUploadRequest	request body	/dspace/submit	Path traversal in the resumable upload implementation allows a user with submitter privileges to create files/directories anywhere on the server.	CWE-22