GitHub Advisoryadvisory · Maven

GHSA-j927-w6g7-7c7w Apache Jena Expression Language Injection vulnerability

HIGH Published 2023-07-12 Modified 2023-07-20 Official page ↗
Aliases
CVE-2023-32200
Ecosystem
Maven
Packages
org.apache.jena:jena
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-917
Reviewed
2023-07-12

Affected packages

• Maven org.apache.jena:jena: >= 3.7.0, < 4.9.0 → fixed in 4.9.0

Description

There is insufficient restrictions of called script functions in Apache Jena versions 4.8.0 and earlier. It allows a remote user to execute javascript via a SPARQL query. This issue affects Apache Jena from 3.7.0 through 4.8.0.

Related

Alias · CVE (1)

  • CVE-2023-32200 There is insufficient restrictions of called script functions in Apache Jena versions 4.8.0 and earlier. vulnerability

Weakness · CWE (1)

  • CWE-917 Improper Neutralization of Special Elements used in an Expression Language Statement weakness

References