CVE-2022-31193

DSpace open source software is a repository application which provides durable access to digital resources. dspace-jspui is a UI component for DSpace. The JSPUI controlled vocabulary servlet is vulnerable to an open redirect attack, where an attacker can craft a malicious URL that looks like a legitimate DSpace/repository URL. When that URL is clicked by the target, it redirects them to a site of the attacker's choice. This issue has been patched in versions 5.11 and 6.4. Users are advised to upgrade. There are no known workaround for this vulnerability.

• CWE-601

• https://github.com/DSpace/DSpace/commit/5f72424a478f59061dcc516b866dcc687bc3f9dePatch, Third Party Advisory
• https://github.com/DSpace/DSpace/commit/f7758457b7ec3489d525e39aa753cc70809d9ad9Patch, Third Party Advisory
• https://github.com/DSpace/DSpace/security/advisories/GHSA-763j-q7wv-vf3mPatch, Third Party Advisory
• https://github.com/DSpace/DSpace/commit/5f72424a478f59061dcc516b866dcc687bc3f9dePatch, Third Party Advisory
• https://github.com/DSpace/DSpace/commit/f7758457b7ec3489d525e39aa753cc70809d9ad9Patch, Third Party Advisory
• https://github.com/DSpace/DSpace/security/advisories/GHSA-763j-q7wv-vf3mPatch, Third Party Advisory

Published

Aug 1, 2022

Last Modified

Jun 17, 2026

Status

Modified

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-31188CVAT is an opensource interactive video and image annotation…9.8
• CVE-2022-31189DSpace open source software is a repository application whic…5.3
• CVE-2022-3119The OAuth client Single Sign On WordPress plugin before 3.0.…7.5
• CVE-2022-31190DSpace open source software is a repository application whic…5.3
• CVE-2022-31191DSpace open source software is a repository application whic…6.1
• CVE-2022-31192DSpace open source software is a repository application whic…6.1
• CVE-2022-31194DSpace open source software is a repository application whic…7.2
• CVE-2022-31195DSpace open source software is a repository application whic…7.2
• CVE-2022-31196Databasir is a database metadata management platform. Databa…7.5
• CVE-2022-31197PostgreSQL JDBC Driver (PgJDBC for short) allows Java progra…8
• CVE-2022-31198OpenZeppelin Contracts is a library for secure smart contrac…7.5
• CVE-2022-31199Remote code execution vulnerabilities exist in the Netwrix A…9.8