CVE-2022-31194 is a path traversal vulnerability affecting the JSPUI component of DSpace open-source repository software. An attacker with submitter privileges can manipulate request parameters during file uploads to create or modify files and directories anywhere on the server writable by the Tomcat/DSpace user. This vulnerability carries a CVSS score of 7.2 (HIGH), indicating a high impact on confidentiality, integrity, and availability, with low attack complexity. However, it requires authenticated access with specific privileges, limiting its exploitability. Currently, there is no evidence of active exploitation, nor are there publicly available exploit tools like Metasploit or Nuclei modules. Community discussion and media coverage for this CVE are minimal.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 4.0, <= 5.10CPE matchmatch criteria | cpe:2.3:a:duraspace:dspace:*:*:*:*:*:*:*:* | ||
> 6.0, < 6.4CPE matchmatch criteria | cpe:2.3:a:duraspace:dspace:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:H
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.3 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.