CVE-2022-31193 URL Redirection to Untrusted Site in Dspace JSPUI

What is CVE-2022-31193?

CVE-2022-31193 is a high-severity vulnerability in DSpace, published on 1 Aug 2022. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

DSpace open source software is a repository application which provides durable access to digital resources. dspace-jspui is a UI component for DSpace. The JSPUI controlled vocabulary servlet is vulnerable to an open redirect attack, where an attacker can craft a malicious URL that looks like a legitimate DSpace/repository URL. When that URL is clicked by the target, it redirects them to a site of the attacker's choice. This issue has been patched in versions 5.11 and 6.4. Users are advised to upgrade. There are no known workaround for this vulnerability.

Weakness: CWE-601

Which versions are affected by CVE-2022-31193?

4 open source packages ship an affected version, including org.dspace:dspace-jspui. It affects 1 product.

Products include Duraspace Dspace.

How do I fix CVE-2022-31193?

Upgrade org.dspace:dspace-jspui to a fixed version for your release line: 5.11 or 6.4.

Is CVE-2022-31193 being exploited?

There is no known exploitation of CVE-2022-31193 in the wild and no public exploit code.

Other vulnerabilities in DSpace

• CVE-2022-31194 Path traversal vulnerabilities in DSpace JSPUI submission upload High 8.2
• CVE-2016-10726 High severity vulnerability that affects org.dspace:dspace-xmlui High 7.5
• CVE-2022-31195 Path traversal vulnerability in Simple Archive Format package import in DSpace High 7.2
• CVE-2021-41189 Communities and collections administrators can escalate their privilege up to system administrator High 7.2
• CVE-2022-31191 Cross Site Scripting possible in DSpace JSPUI spellcheck and autocomplete tools High 7.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-763j-q7wv-vf3m.