TI-2022-13230 Aliases CVE-2022-31190 GHSA-7w85-pp86-p4pq

Metadata of withdrawn Items is exposed to anonymous users in DSpace XMLUI

LOW 32CWE-200Published 2022-08-01 · Updated 2025-04-23

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Information disclosure, Security bypass
Confidentiality · integrity · availability: Low · None · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-200 and CWE-863.

Summary

DSpace open source software is a repository application which provides durable access to digital resources. dspace-xmlui is a UI component for DSpace. In affected versions metadata on a withdrawn Item is exposed via the XMLUI "mets.xml" object, as long as you know the handle/URL of the withdrawn Item. This vulnerability only impacts the XMLUI. Users are advised to upgrade to version 6.4 or newer.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00921 60th percentileScored 2026-11-07

Fix Fixed DSpace (DSpace): 6.4org.dspace:dspace-xmlui (Maven): 6.4

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
DSpace	DSpace	4.0 to before 6.4	6.4	Patch available	CNA
—	org.dspace:dspace-xmlui (Maven)	4.0 to before 6.4	6.4	Patch available	GHSA-7w85-pp86-p4pq

DSpace VendorDSpace Affected 4.0 to before 6.4 Fixed in 6.4 Patch available CNA
org.dspace:dspace-xmlui (Maven) Vendor— Affected 4.0 to before 6.4 Fixed in 6.4 Patch available GHSA-7w85-pp86-p4pq

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:duraspace:dspace::::::::	4.0 to before 6.4	Vulnerable	DSpace

cpe:2.3:a:duraspace:dspace:*:*:*:*:*:*:*:* Versions 4.0 to before 6.4 Vulnerable ·DSpace

Remediation

Fix · CNA DSpace (DSpace) Fixed in 6.4
Fix · GHSA-7w85-pp86-p4pq org.dspace:dspace-xmlui (Maven) Fixed in 6.4 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2022-31190
2026-10-03 Alias added: GHSA-7w85-pp86-p4pq

References

Patch 3

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2022-31190

Other 1

https://github.com/DSpace/DSpace

TI-2022-13234 Path traversal vulnerabilities in DSpace JSPUI submission upload CVSS 3.1HIGH 8.2
TI-2022-13235 Path traversal vulnerability in Simple Archive Format package import in DSpace CVSS 3.1HIGH 7.2
TI-2016-08766 The XMLUI feature in DSpace before 3.6, 4.x before 4.5, and 5.x before 5.5 allows… CVSS 3.0HIGH 7.5
TI-2021-18028 Communities and collections administrators can escalate their privilege up to system administrator CVSS 3.1HIGH 7.2
TI-2022-13233 URL Redirection to Untrusted Site in Dspace JSPUI CVSS 3.1HIGH 7.1
TI-2022-13232 Cross Site Scripting possible in DSpace JSPUI "Request a Copy" feature CVSS 3.1HIGH 7.1

See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences