What’s Vulnerable › Vulnerabilities

CVE-2022-31190: Metadata of withdrawn Items is exposed to anonymous users in DSpace XMLUI

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.9% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-08-01 · updated 2026-06-17
• Weakness: CWE-200

Description

DSpace open source software is a repository application which provides durable access to digital resources. dspace-xmlui is a UI component for DSpace. In affected versions metadata on a withdrawn Item is exposed via the XMLUI "mets.xml" object, as long as you know the handle/URL of the withdrawn Item. This vulnerability only impacts the XMLUI. Users are advised to upgrade to version 6.4 or newer.

Affected products

• DSpace: from 4.0 before 6.4 — fixed in 6.4

How to fix

Upgrade to a fixed version: DSpace 6.4. Check the vendor advisory for mitigations.

References

• https://github.com/DSpace/DSpace/commit/574e25496a40173653ae7d0a49a19ed8e3458606.patch
• https://github.com/DSpace/DSpace/pull/2451
• https://github.com/DSpace/DSpace/security/advisories/GHSA-7w85-pp86-p4pq
• https://github.com/DSpace/DSpace/commit/574e25496a40173653ae7d0a49a19ed8e3458606.patch
• https://github.com/DSpace/DSpace/pull/2451
• https://github.com/DSpace/DSpace/security/advisories/GHSA-7w85-pp86-p4pq

Get alerted when CVE-2022-31190 or the next vulnerability affects your stack