Lucene search
Veracode Vulnerability DatabaseVERACODE:36563HistoryAug 02, 2022 - 9:27 a.m.
Information Disclosure
2022-08-0209:27:20
Veracode Vulnerability Database
sca.analysiscenter.veracode.com
8
0.001 Low
EPSS
Percentile
31.0%
dspace-xmlui is vulnerable to information disclosure. The vulnerability exists because the generate function of DSpaceMETSGenerator.java does not properly check the read permissions for METS values, allowing an attacker to gain sensitive information through the XMLUI mets.xml object.
References
github.com/DSpace/DSpace/commit/574e25496a40173653ae7d0a49a19ed8e3458606
github.com/DSpace/DSpace/commit/574e25496a40173653ae7d0a49a19ed8e3458606.patch
github.com/DSpace/DSpace/pull/2451
github.com/DSpace/DSpace/security/advisories/GHSA-7w85-pp86-p4pq
jira.duraspace.org/browse/DS-1922
jira.duraspace.org/browse/DS-304
Related
cve
cve
CVE-2022-31190
2022-08-01 20:15:08
prion
prion
Design/Logic Flaw
2022-08-01 20:15:00
cvelist
cvelist
github
github
XMLUI's metadata of withdrawn Items is exposed to anonymous users
2022-08-06 05:40:16
osv
osv
XMLUI's metadata of withdrawn Items is exposed to anonymous users
2022-08-06 05:40:16
CVE-2022-31190
2022-08-01 20:15:08
nvd
nvd
CVE-2022-31190
2022-08-01 20:15:08