CVE-2022-31189CWE-209

"Internal System Error" page in DSpace JSPUI prints exceptions and stack traces without sanitization

Medium · published August 1, 2022

CVSS v3.1
5.3
EPSS
1%
Percentile
53.5
In the wild
Unconfirmed
What it is

DSpace open source software is a repository application which provides durable access to digital resources. dspace-jspui is a UI component for DSpace. When an "Internal System Error" occurs in the JSPUI, then entire exception (including stack trace) is available. Information in this stacktrace may be useful to an attacker in launching a more sophisticated attack. This vulnerability only impacts the JSPUI. This issue has been fixed in version 6.4. users are advised to upgrade. Users unable to upgrade should disable the display of error messages in their internal.jsp file.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00723 · 53.5th percentile
Weakness
CWE-209 · Generation of Error Message Containing Sensitive Information
Published
2022-08-01T20:20Z
EPSS history
Timeline
  • 01 AUG 20:20Z
    "Internal System Error" page in DSpace JSPUI prints exceptions and stack traces without sanitization
    cvelistv5