CVE-2023-22665 — Apache Jena: Exposure of arbitrary execution in script engine expressions.

CVE-2023-22665

Apache Jena: Exposure of arbitrary execution in script engine expressions. PUBLISHED

Description (CNA)

There is insufficient checking of user queries in Apache Jena versions 4.7.0 and earlier, when invoking custom scripts. It allows a remote user to execute arbitrary javascript via a SPARQL query.

Affected (CNA)

Vendor / product	Versions
Apache Software Foundation / Apache Jena	affected 0 through 4.7.0

CWE

CWE-917

References

https://lists.apache.org/thread/s0dmpsxcwqs57l4qfs415klkgmhdxq7s
http://www.openwall.com/lists/oss-security/2023/07/11/11

ADP enrichment

CVE

No English description supplied.

https://lists.apache.org/thread/s0dmpsxcwqs57l4qfs415klkgmhdxq7s
http://www.openwall.com/lists/oss-security/2023/07/11/11