What is GHSA-xgh5-gwq5-rpx8?

GHSA-xgh5-gwq5-rpx8 is a security advisory published by GitHub Security Advisories with Medium severity. Arbitrary javascript injection in Apache Jena

Which CVE IDs does GHSA-xgh5-gwq5-rpx8 cover?

GHSA-xgh5-gwq5-rpx8 covers the following CVE IDs: CVE-2023-22665. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-xgh5-gwq5-rpx8?

GHSA-xgh5-gwq5-rpx8 has a CVSS v3 base score of 5.4, published by GitHub Security Advisories.

Which products are affected by GHSA-xgh5-gwq5-rpx8?

GHSA-xgh5-gwq5-rpx8 affects 1 product, including: maven/org.apache.jena:jena:\u003c 4.8.0.

GHSA-xgh5-gwq5-rpx8MediumCVSS 5.4

Arbitrary javascript injection in Apache Jena

Vendor

GitHub Security Advisories

Published

April 25, 2023

Last Modified

November 7, 2023

🔗 CVE IDs covered (1)

CVE-2023-22665 →

📋 Description

There is insufficient checking of user queries in Apache Jena versions 4.7.0 and earlier, when invoking custom scripts. It allows a remote user to execute arbitrary javascript via a SPARQL query.

🎯 Affected products1

maven/org.apache.jena:jena:< 4.8.0

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2023-22665
https://lists.apache.org/thread/s0dmpsxcwqs57l4qfs415klkgmhdxq7s
http://www.openwall.com/lists/oss-security/2023/07/11/11
https://github.com/advisories/GHSA-xgh5-gwq5-rpx8