CVE-2022-31190 : What You Need to Know
Learn about CVE-2022-31190, a vulnerability in DSpace XMLUI allowing access to withdrawn Item metadata, impacting versions >= 4.0, < 6.4. Upgrade to version 6.4 or above for protection.
DSpace is an open-source repository application providing durable access to digital resources. In the DSpace XMLUI component, a vulnerability exists where metadata of withdrawn Items is exposed to anonymous users via the "mets.xml" object if the handle/URL is known. Upgrading to version 6.4 or newer is recommended.
Understanding CVE-2022-31190
This CVE involves the exposure of sensitive information to unauthorized actors through the DSpace XMLUI interface.
What is CVE-2022-31190?
CVE-2022-31190 pertains to DSpace's XMLUI component, where metadata on withdrawn Items can be accessed by anonymous users, posing a risk of exposing sensitive information.
The Impact of CVE-2022-31190
This vulnerability can potentially lead to unauthorized access to withdrawn Item metadata by anonymous users, compromising confidentiality.
Technical Details of CVE-2022-31190
In the affected DSpace versions (>= 4.0, < 6.4), users accessing the XMLUI can view metadata of withdrawn Items if they know the handle/URL, creating a security risk.
Vulnerability Description
The flaw allows unauthorized users to access metadata of withdrawn Items through the XMLUI, potentially exposing sensitive information.
Affected Systems and Versions
Users of DSpace versions between 4.0 and 6.4 are impacted by this vulnerability within the XMLUI component.
Exploitation Mechanism
By leveraging the handle/URL of a withdrawn Item, malicious actors can exploit this vulnerability to access and retrieve sensitive metadata.
Mitigation and Prevention
To address CVE-2022-31190 in DSpace:
Immediate Steps to Take
Upgrade to DSpace version 6.4 or newer to mitigate the risk of unauthorized access to withdrawn Item metadata via the XMLUI.
Long-Term Security Practices
Regularly monitor and update DSpace installations to ensure the latest security patches are applied and sensitive information remains protected.
Patching and Updates
Stay informed about security updates for DSpace and promptly apply patches to mitigate known vulnerabilities.