CVE-2023-32200 — Apache Jena: Exposure of execution in script engine expressions.

CVE-2023-32200

Apache Jena: Exposure of execution in script engine expressions. PUBLISHED

Description (CNA)

There is insufficient restrictions of called script functions in Apache Jena versions 4.8.0 and earlier. It allows a remote user to execute javascript via a SPARQL query. This issue affects Apache Jena: from 3.7.0 through 4.8.0.

Affected (CNA)

Vendor / product	Versions
Apache Software Foundation / Apache Jena	affected 3.7.0 through 4.8.0

CWE

CWE-917

References

https://www.cve.org/CVERecord?id=CVE-2023-22665
https://lists.apache.org/thread/7hg0t2kws3fyr75dl7lll8389xzzc46z

ADP enrichment

CVE

No English description supplied.

https://www.cve.org/CVERecord?id=CVE-2023-22665
https://lists.apache.org/thread/7hg0t2kws3fyr75dl7lll8389xzzc46z

CISA-ADP

No English description supplied.

No references supplied.