CVE-2023-22665

Опубликовано: 25 апр. 2023

Источник: nvd

CVSS3: 5.4

EPSS Низкий

Описание

There is insufficient checking of user queries in Apache Jena versions 4.7.0 and earlier, when invoking custom scripts. It allows a remote user to execute arbitrary javascript via a SPARQL query.

Ссылки

http://www.openwall.com/lists/oss-security/2023/07/11/11
Mailing List
Third Party Advisory
https://lists.apache.org/thread/s0dmpsxcwqs57l4qfs415klkgmhdxq7s
Issue Tracking
Mailing List
http://www.openwall.com/lists/oss-security/2023/07/11/11
Mailing List
Third Party Advisory
https://lists.apache.org/thread/s0dmpsxcwqs57l4qfs415klkgmhdxq7s
Issue Tracking
Mailing List

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:apache:jena:*:*:*:*:*:*:*:*

Версия от 3.7.0 (включая) до 4.8.0 (включая)

EPSS

Процентиль: 76%

0.0099

Низкий

5.4 Medium

CVSS3

Дефекты

CWE-917

Связанные уязвимости

CVE-2023-22665

CVSS3: 5.4

ubuntu

почти 3 года назад

There is insufficient checking of user queries in Apache Jena versions 4.7.0 and earlier, when invoking custom scripts. It allows a remote user to execute arbitrary javascript via a SPARQL query.

CVE-2023-22665

CVSS3: 5.4

debian

почти 3 года назад

There is insufficient checking of user queries in Apache Jena versions ...

GHSA-xgh5-gwq5-rpx8

CVSS3: 5.4

github

почти 3 года назад

Arbitrary javascript injection in Apache Jena

EPSS

Процентиль: 76%

0.0099

Низкий

5.4 Medium

CVSS3

Дефекты

CWE-917