CVE-2023-22665: Arbitrary javascript injection in Apache Jena
Summary
CVE-2023-22665: Arbitrary javascript injection in Apache Jena. Affects org.apache.jena:jena versions < 4.8.0. Fixed in 4.8.0. How to fix ↓
Also tracked for
- apache-jena · Debian:12
The same CVE-2023-22665 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Apache Jena is an open-source Java framework for building semantic web and linked data applications. It provides a set of APIs and tools for working with RDF (Resource Description Framework) data. The vulnerability affects Apache Jena versions 4.7.0 and earlier. These versions do not properly validate user queries when invoking custom scripts, allowing a remote user to execute arbitrary JavaScript via a SPARQL query.
Vulnerability Detail
The vulnerability in Apache Jena versions 4.7.0 and earlier arises from the lack of sufficient checking of user queries when executing custom scripts. This allows an attacker to inject arbitrary JavaScript code through a SPARQL query. As a result, the attacker can execute malicious actions on the affected system, potentially compromising its security and integrity. The impact of this vulnerability is considered moderate with a CVSS score of 5.4.
How To Fix
Minimum fixed version
4.8.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the recommended fix by upgrading to Apache Jena version 4.8.0 or later.
Conclusion
The vulnerability in Apache Jena versions 4.7.0 and earlier allows for arbitrary JavaScript injection through a SPARQL query. It is crucial to upgrade to Apache Jena version 4.8.0 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.jena:jena →
FAQ
Apache Jena is an open-source Java framework for building semantic web and linked data applications. It provides APIs and tools for working with RDF data.
SPARQL (SPARQL Protocol and RDF Query Language) is a query language used to retrieve and manipulate data stored in RDF format.
JavaScript injection is a type of security vulnerability where an attacker can insert malicious JavaScript code into a web application, which is then executed by unsuspecting users.
The vulnerability allows an attacker to execute arbitrary JavaScript code, which can lead to various consequences such as unauthorized access, data manipulation, and further exploitation of the affected system.
You can use Vulert's playground (https://vulert.com/scanner) to check if your Apache Jena installation is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities without requiring access to the code or installation.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.jena:jena.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
