5.3 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
0.001 Low
EPSS
Percentile
26.2%
When an “Internal System Error” occurs in the JSPUI, then entire exception (including stack trace) is available. Information in this stacktrace may be useful to an attacker in launching a more sophisticated attack. This vulnerability only impacts the JSPUI.
This vulnerability does NOT impact the XMLUI or 7.x.
DSpace 6.x:
DSpace 5.x:
internal.jsp
is not necessary for the JSPUI to function.If at all possible, we recommend upgrading your DSpace site based on the upgrade instructions. However, if you are unable to do so, you can manually apply the above patches as follows:
[dspace-src]
folder, apply the patch, e.g. git apply [name-of-file].patch
mvn -U clean package
(This will recompile all DSpace code)ant update
(This will copy all updated WARs / configs to your installation directory). Depending on your setup you also may need to copy the updated WARs over to your Tomcat webapps folder.The detailed error information embedded in internal.jsp
is not necessary for the JSPUI to function. Because this error information is also available in the dspace.log
files, it does not need to be displayed in internal.jsp
.
Modify your internal.jsp
, and disable the display of the error message. This is most easily done by setting the returned exception to “null” at all times. For example, add a new line between line number 43 and 44
// This line should exist around line number 43
Throwable ex = (Throwable) request.getAttribute("javax.servlet.error.exception");
// Add workaround for security issue. Ensure exception is always set to null.
ex = null;
// This line should exist around line number 44
if(ex == null) out.println("No stack trace available<br />");
Discovered & reported by Ozkan Erdogan (Brunel University London)
If you have any questions or comments about this advisory: