duraspace vulnerabilities

Products

• dspace 9
• vitro 1

Latest duraspace CVEs

Newest publication first

1. CVE-2022-31195 Path traversal vulnerability in Simple Archive Format package import in DSpace

   Published 2022-08-01

   High·CVSS 7.2 EPSS 2.0%

   DSpace open source software is a repository application which provides durable access to digital resources. In affected versions the ItemImportServiceImpl is vulnerable to a path traversal vulnerability. This means a malicious SAF (simple archive format) package could cause a fil...

2. CVE-2022-31192 Cross Site Scripting possible in DSpace JSPUI "Request a Copy" feature

   Published 2022-08-01

   Medium·CVSS 6.1 EPSS 0.79%

   DSpace open source software is a repository application which provides durable access to digital resources. dspace-jspui is a UI component for DSpace. The JSPUI "Request a Copy" feature does not properly escape values submitted and stored from the "Request a Copy" form. This mean...

3. CVE-2022-31191 Cross Site Scripting possible in DSpace JSPUI spellcheck and autocomplete tools

   Published 2022-08-01

   Medium·CVSS 6.1 EPSS 0.81%

   DSpace open source software is a repository application which provides durable access to digital resources. dspace-jspui is a UI component for DSpace. The JSPUI spellcheck "Did you mean" HTML escapes the data-spell attribute in the link, but not the actual displayed text. Similar...

4. CVE-2022-31194 Path traversal vulnerabilities in DSpace JSPUI submission upload

   Published 2022-08-01

   High·CVSS 7.2 EPSS 1.5%

   DSpace open source software is a repository application which provides durable access to digital resources. dspace-jspui is a UI component for DSpace. The JSPUI resumable upload implementations in SubmissionController and FileUploadRequest are vulnerable to multiple path traversa...

5. CVE-2022-31193 URL Redirection to Untrusted Site in Dspace JSPUI

   Published 2022-08-01

   Medium·CVSS 6.1 EPSS 0.89%

   DSpace open source software is a repository application which provides durable access to digital resources. dspace-jspui is a UI component for DSpace. The JSPUI controlled vocabulary servlet is vulnerable to an open redirect attack, where an attacker can craft a malicious URL tha...

6. CVE-2022-31189 "Internal System Error" page in DSpace JSPUI prints exceptions and stack traces without sanitization

   Published 2022-08-01

   Medium·CVSS 5.3 EPSS 0.72%

   DSpace open source software is a repository application which provides durable access to digital resources. dspace-jspui is a UI component for DSpace. When an "Internal System Error" occurs in the JSPUI, then entire exception (including stack trace) is available. Information in t...

7. CVE-2022-31190 Metadata of withdrawn Items is exposed to anonymous users in DSpace XMLUI

   Published 2022-08-01

   Medium·CVSS 5.3 EPSS 0.92%

   DSpace open source software is a repository application which provides durable access to digital resources. dspace-xmlui is a UI component for DSpace. In affected versions metadata on a withdrawn Item is exposed via the XMLUI "mets.xml" object, as long as you know the handle/URL...

8. CVE-2021-41189 Communities and collections administrators can escalate their privilege up to system administrator

   Published 2021-10-29

   High·CVSS 7.2 EPSS 2.1%

   DSpace is an open source turnkey repository application. In version 7.0, any community or collection administrator can escalate their permission up to become system administrator. This vulnerability only exists in 7.0 and does not impact 6.x or below. This issue is patched in ver...

9. CVE-2019-6986 Command Injection in VIVO Vitro

   Published 2019-01-28

   High·CVSS 7.5 EPSS 3.0% Public exploit

   SPARQL Injection in VIVO Vitro v1.10.0 allows a remote attacker to execute arbitrary SPARQL via the uri parameter, leading to a regular expression denial of service (ReDoS), as demonstrated by crafted use of FILTER%20regex in a /individual?uri= request.

10. CVE-2016-10726 High severity vulnerability that affects org.dspace:dspace-xmlui

    Published 2018-07-10

    High·CVSS 7.5 EPSS 2.9%

    The XMLUI feature in DSpace before 3.6, 4.x before 4.5, and 5.x before 5.5 allows directory traversal via the themes/ path in an attack with two or more arbitrary characters and a colon before a pathname, as demonstrated by a themes/Reference/aa:etc/passwd URI.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.