There is insufficient checking of user queries in Apache Jena versions 4.7.0 and earlier, when invoking custom scripts. It allows a remote user to execute arbitrary javascript via a SPARQL query.
5.4CVSS
6.1AI Score
0.002EPSS
There is insufficient restrictions of called script functions in Apache Jenaversions 4.8.0 and earlier. It allows aremote user to execute javascript via a SPARQL query.This issue affects Apache Jena: from 3.7.0 through 4.8.0.
8.8CVSS
8.6AI Score
0.003EPSS