Miggo Logo
Miggo Vulnerability Database
→
CVE-2022-31193

CVE-2022-31193: JSPUI's controlled vocabulary feature vulnerable to Open Redirect before v6.4 and v5.11

7.1

CVSS Score
3.1

Basic Information

CVE ID
CVE-2022-31193
GHSA ID
GHSA-763j-q7wv-vf3m
EPSS Score
0.23009%
CWE
CWE-601
Published
8/6/2022
Updated
1/27/2023
KEV Status
No
Technology
TechnologyJava

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Package NameEcosystemVulnerable VersionsFirst Patched Version
org.dspace:dspace-jspuimaven>= 4.0, < 5.115.11
org.dspace:dspace-jspuimaven>= 6.0, < 6.46.4

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from improper validation of the 'callerUrl' parameter in the controlled vocabulary servlet. The commit diff shows the patch added a context path check to prevent external redirects. The doDSGet() method was vulnerable because it directly used the unvalidated 'callerUrl' parameter for redirection. This matches the CWE-601 description of open redirects through unvalidated redirect parameters.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

### Imp**t T** JSPUI *ontroll** vo***ul*ry s*rvl*t is vuln*r**l* to *n op*n r**ir**t *tt**k, w**r* *n *tt**k*r **n *r**t * m*li*ious URL t**t looks lik* * l**itim*t* *Sp***/r*pository URL. W**n t**t URL is *li*k** *y t** t*r**t, it r**ir**ts t**m to

Reasoning

T** vuln*r**ility st*ms *rom improp*r `v*li**tion` o* t** '**ll*rUrl' p*r*m*t*r in t** *ontroll** vo***ul*ry s*rvl*t. T** *ommit *i** s*ows t** p*t** ***** * *ont*xt p*t* ****k to pr*v*nt *xt*rn*l r**ir**ts. T** `*o*S**t()` m*t*o* w*s vuln*r**l* ****