CVE-2023-22665 | BDVDB-2026-200959 Detail

ApacheApache Jena

Description#

There is insufficient checking of user queries in Apache Jena versions 4.7.0 and earlier, when invoking custom scripts. It allows a remote user to execute arbitrary javascript via a SPARQL query.

Impact#

No impact statement in the source data.

Weaknesses#

CWE-917 Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')

References#

https://lists.apache.org/thread/s0dmpsxcwqs57l4qfs415klkgmhdxq7s
http://www.openwall.com/lists/oss-security/2023/07/11/11

Exploit#

No public exploit known

History#

Version 12023-04-25Record published in the CVE List.
Version 22025-02-13Most recent update recorded in the CVE List.