CVE-2022-31193

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2022-31193
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-31193.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2022-31193
Aliases
Published
2022-08-01T20:25:12Z
Modified
2026-10-21T08:19:30Z
Severity
  • 7.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L CVSS Calculator
Summary
URL Redirection to Untrusted Site in Dspace JSPUI
Details

DSpace open source software is a repository application which provides durable access to digital resources. dspace-jspui is a UI component for DSpace. The JSPUI controlled vocabulary servlet is vulnerable to an open redirect attack, where an attacker can craft a malicious URL that looks like a legitimate DSpace/repository URL. When that URL is clicked by the target, it redirects them to a site of the attacker's choice. This issue has been patched in versions 5.11 and 6.4. Users are advised to upgrade. There are no known workaround for this vulnerability.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-601"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/31xxx/CVE-2022-31193.json"
}
References

Affected packages

Git / github.com/dspace/dspace

Affected ranges

Type
GIT
Repo
https://github.com/dspace/dspace
Events
Introduced
0fea17436854acf9048b0e11fbf988333ea02956
Fixed
66647c7bf939b202a4872d4c5ebda23bc62e807f
Introduced
d34e7b89a30b5ffd35556d6fe8936e5d8659415d
Fixed
d1795b598aa78c37cade6fbc83c8e4141f865a6e
Fixed
5f72424a478f59061dcc516b866dcc687bc3f9de
Fixed
f7758457b7ec3489d525e39aa753cc70809d9ad9
Database specific
Show details 
{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "6.0"
                },
                {
                    "fixed":  "6.4"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StringRangeExpression"
        },
        {
            "range":  [
                {
                    "introduced":  "4.0"
                },
                {
                    "fixed":  "5.11"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StringRangeExpression"
        },
        {
            "range":  [
                {
                    "fixed":  "5f72424a478f59061dcc516b866dcc687bc3f9de"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        },
        {
            "range":  [
                {
                    "fixed":  "f7758457b7ec3489d525e39aa753cc70809d9ad9"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

dspace-4.*
dspace-4.0
dspace-5.*
dspace-5.0
dspace-5.0-rc1
dspace-5.0-rc2
dspace-5.0-rc3
dspace-5.1
dspace-5.10
dspace-5.2
dspace-5.3
dspace-5.4
dspace-5.5
dspace-5.6
dspace-5.7
dspace-5.8
dspace-5.9
dspace-6.*
dspace-6.0
dspace-6.1
dspace-6.2
dspace-6.3

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-31193.json"
vanir_signatures 
[
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "194256693938643061146082747784343617780",
                "74097944488310406589478838007677848881",
                "274268665387351830738484623536498219154",
                "8206378877108847774533840159145203315",
                "146508925465581470121161005701242566557",
                "140751182846231614761886246628891142077",
                "70468589860306572260587328004349284239",
                "291195736580888230876166404512085943559",
                "206362487785960115410173619202220527132"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2022-31193-07f0f981",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/dspace/dspace/commit/5f72424a478f59061dcc516b866dcc687bc3f9de",
        "target":  {
            "file":  "dspace-jspui/src/main/java/org/dspace/app/webui/servlet/ControlledVocabularyServlet.java"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "119780573979426861905177072604783249930",
            "length":  554
        },
        "id":  "CVE-2022-31193-1b7d076c",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/dspace/dspace/commit/5f72424a478f59061dcc516b866dcc687bc3f9de",
        "target":  {
            "file":  "dspace-jspui/src/main/java/org/dspace/app/webui/servlet/ControlledVocabularyServlet.java",
            "function":  "doDSGet"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "194256693938643061146082747784343617780",
                "74097944488310406589478838007677848881",
                "274268665387351830738484623536498219154",
                "8206378877108847774533840159145203315",
                "146508925465581470121161005701242566557",
                "140751182846231614761886246628891142077",
                "70468589860306572260587328004349284239",
                "291195736580888230876166404512085943559",
                "206362487785960115410173619202220527132"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2022-31193-476b8510",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/dspace/dspace/commit/f7758457b7ec3489d525e39aa753cc70809d9ad9",
        "target":  {
            "file":  "dspace-jspui/src/main/java/org/dspace/app/webui/servlet/ControlledVocabularyServlet.java"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "119780573979426861905177072604783249930",
            "length":  554
        },
        "id":  "CVE-2022-31193-85275fcc",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/dspace/dspace/commit/f7758457b7ec3489d525e39aa753cc70809d9ad9",
        "target":  {
            "file":  "dspace-jspui/src/main/java/org/dspace/app/webui/servlet/ControlledVocabularyServlet.java",
            "function":  "doDSGet"
        }
    }
]
vanir_signatures_modified 
"2026-10-21T08:19:30Z"