CVE-2022-31190: XMLUI's metadata of withdrawn Items is exposed to anonymous users in org.dspace:dspace-xmlui
Summary
CVE-2022-31190: XMLUI's metadata of withdrawn Items is exposed to anonymous users. Affects org.dspace:dspace-xmlui versions >= 4.0, < 6.4. Fixed in 6.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
org.dspace:dspace-xmlui is a Maven package that provides XMLUI functionality for DSpace, an open-source repository software. XMLUI is a user interface for DSpace that allows users to interact with the repository through a web interface. This package is vulnerable to an issue where metadata of withdrawn Items is exposed to anonymous users via the XMLUI 'mets.xml' object. This vulnerability only affects the XMLUI component of DSpace and does not impact the JSPUI or DSpace 7.x. The metadata of withdrawn Items can be accessed by knowing the handle/URL of the withdrawn Item.
Vulnerability Detail
The vulnerability allows anonymous users to access metadata of withdrawn Items through the XMLUI 'mets.xml' object. This can potentially expose sensitive information, although Item metadata typically does not contain highly secure or sensitive data. The vulnerability has a CVSS score of 5.3, indicating a moderate severity level. It affects versions of org.dspace:dspace-xmlui up to 6.3.
How To Fix
Minimum fixed version
6.4
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If there are withdrawn items with highly secure information in their metadata, it is recommended to permanently delete them. This will ensure that their secure metadata is inaccessible and removed from the system entirely.
Conclusion
The vulnerability in org.dspace:dspace-xmlui allows anonymous users to access metadata of withdrawn Items. It is recommended to update to version 6.4 or above to fix the vulnerability. If highly secure information is present in withdrawn item metadata, it is advised to permanently delete those items. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for org.dspace:dspace-xmlui →
FAQ
org.dspace:dspace-xmlui is a Maven package that provides XMLUI functionality for DSpace, an open-source repository software.
XMLUI is a user interface for DSpace that allows users to interact with the repository through a web interface.
The vulnerability exposes metadata of withdrawn Items to anonymous users, potentially exposing sensitive information.
The vulnerability has a CVSS score of 5.3, indicating a moderate severity level.
To fix this vulnerability, update to version 6.4 or above of org.dspace:dspace-xmlui. Apply the provided patch if an immediate upgrade is not possible.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.dspace:dspace-xmlui.
