CVE-2023-22665CWE-917

Apache Jena: Exposure of arbitrary execution in script engine expressions.

published April 25, 2023

CVSS
—
EPSS
1%
Percentile
71.0
In the wild
Unconfirmed
What it is

There is insufficient checking of user queries in Apache Jena versions 4.7.0 and earlier, when invoking custom scripts. It allows a remote user to execute arbitrary javascript via a SPARQL query.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01335 · 71.0th percentile
Weakness
CWE-917 · Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')
Published
2023-04-25T06:44Z
EPSS history
Timeline
  • 25 APR 06:44Z
    Apache Jena: Exposure of arbitrary execution in script engine expressions.
    cvelistv5