medium5.4
CVE-2023-22665
Arbitrary javascript injection in Apache Jena
Impact
There is insufficient checking of user queries in Apache Jena versions 4.7.0 and earlier, when invoking custom scripts. It allows a remote user to execute arbitrary javascript via a SPARQL query.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | org.apache.jena:jena | < 4.8.0 | 4.8.0 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Apache | Jena | from 3.7.0 through 4.8.0 |