Information Disclosure

dspace-xmlui is vulnerable to information disclosure. The vulnerability exists because the generate function of DSpaceMETSGenerator.java does not properly check the read permissions for METS values, allowing an attacker to gain sensitive information through the XMLUI mets.xml object...