CVE-2024-38364CWE-79

DSpace Cross Site Scripting (XSS) via a deposited HTML/XML document

Low · published June 25, 2024

CVSS v3.1
2.6
EPSS
0%
Percentile
32.3
In the wild
Unconfirmed
What it is

DSpace is an open source software is a turnkey repository application used by more than 2,000 organizations and institutions worldwide to provide durable access to digital resources. In DSpace 7.0 through 7.6.1, when an HTML, XML or JavaScript Bitstream is downloaded, the user's browser may execute any embedded JavaScript. If that embedded JavaScript is malicious, there is a risk of an XSS attack. This vulnerability has been patched in version 7.6.2.

The record
Technical detail
CVSS v3.1
2.6 · LOW
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.00393 · 32.3th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2024-06-25T23:45Z
EPSS history
Timeline
  • 25 JUN 23:45Z
    DSpace Cross Site Scripting (XSS) via a deposited HTML/XML document
    cvelistv5