XSS in Dspace
CVE-2024-38364
DSpace is an open source software is a turnkey repository application used by more than 2,000 organizations and institutions worldwide to provide durable access to digital resources. In DSpace 7.0 through 7.6.1, when an HTML, XML or JavaScript Bitstream is downloaded, the user's browser may execute any embedded JavaScript. If that embedded JavaScript is malicious, there is a risk of an XSS attack. This vulnerability has been patched in version 7.6.2.
Vulnerability class: XSS (Cross-Site Scripting)
EPSS: 0.004 (31.9th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 2.6 (Low). Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:L.
Affected products
- Dspace — versions >= 7.0, < 7.6.2
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_CONFIRM)
- security-advisories@github.com (x_refsource_MISC)
- security-advisories@github.com (x_refsource_MISC)
- security-advisories@github.com (x_refsource_MISC)
Frequently asked questions
- What is CVE-2024-38364?
- CVE-2024-38364 is a low-severity vulnerability in Dspace, classified under Cross-site Scripting. CVSS score: 2.6/10. Published 2024-06-26.
- How severe is CVE-2024-38364?
- Low severity. CVSS v3 base score is 2.6 out of 10.