CVE-2022-31190

MEDIUM

DSpace 4.0-6.3 - Exposure of Sensitive Information via XMLUI mets.xml

Title source: llm
STIX 2.1

Description

DSpace open source software is a repository application which provides durable access to digital resources. dspace-xmlui is a UI component for DSpace. In affected versions metadata on a withdrawn Item is exposed via the XMLUI "mets.xml" object, as long as you know the handle/URL of the withdrawn Item. This vulnerability only impacts the XMLUI. Users are advised to upgrade to version 6.4 or newer.

References (3)

Core 3
Core References
Patch, Third Party Advisory x_refsource_confirm
https://github.com/DSpace/DSpace/security/advisories/GHSA-7w85-pp86-p4pq
Patch, Third Party Advisory x_refsource_misc
https://github.com/DSpace/DSpace/pull/2451

Scores

CVSS v3 5.3
EPSS 0.0069
EPSS Percentile 48.0%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact partial

Details

CWE
CWE-200 CWE-863
Status published
Products (2)
duraspace/dspace 4.0 - 6.4
org.dspace/dspace-xmlui 4.0 - 6.4Maven
Published Aug 01, 2022
Tracked Since Feb 18, 2026