Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Maven package

org.dspace:dspace-xmlui

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 5.3MavenPublished

    XMLUI's metadata of withdrawn Items is exposed to anonymous users

    CVE-2022-31190 · GHSA-7w85-pp86-p4pq

    Affected
    • Maven org.dspace:dspace-xmlui >= 4.0, <= 6.3
    Fixed in
    6.4· Vendor fix available
    Issue
    Impact Metadata on a withdrawn Item is exposed via the XMLUI "mets.xml" object, as long as you know the handle/URL of the withdrawn Item. This vulnerability only impacts the XMLUI. However, this vulnerability is very low severity as Item metadata does not tend to contain highly secure or sensitive information. This vulnerability does NOT impact the JSPUI or 7.x. Patches Because of the low severity of this security issue, it requires updating to 6.4 to resolve. No patch is available for 5.x or below. DSpace 6.x: Fixed in 6.4 via #2451 6.x patch file: https://github.com/DSpace/DSpace/commit/574e25496a40173653ae7d0a49a19ed8e3458606.patch (may be applied manually if an immediate upgrade to 6.4 or above is not possible) Apply the patch to your DSpace If at all possible, we recommend upgrading your DSpace site based on the upgrade instructions. However, if you are unable to do so, you can manually apply the above patches as follows: 1. Download the appropriate patch file to the machine…

    Recommended action: Upgrade to 6.4 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →
  2. High, CVSS 7.5MavenPublished

    High severity vulnerability that affects org.dspace:dspace-xmlui

    CVE-2016-10726 · GHSA-4m9r-5gqp-7j82

    Affected
    • Maven org.dspace:dspace-xmlui >= 4.0, < 4.5; >= 5.0, < 5.5; < 3.6
    Fixed in
    5.53.64.5· Vendor fix available
    Issue
    The XMLUI feature in DSpace before 3.6, 4.x before 4.5, and 5.x before 5.5 allows directory traversal via the themes/ path in an attack with two or more arbitrary characters and a colon before a pathname, as demonstrated by a themes/Reference/aa:etc/passwd URI.

    Recommended action: Upgrade to 5.5, 4.5 or 3.6 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →