CVE-2022-31190 - CVE House
Back to Database
Status published Medium CVE-2022-31190

Metadata of withdrawn Items is exposed to anonymous users in DSpace XMLUI

Vulnerability Description

DSpace open source software is a repository application which provides durable access to digital resources. dspace-xmlui is a UI component for DSpace. In affected versions metadata on a withdrawn Item is exposed via the XMLUI "mets.xml" object, as long as you know the handle/URL of the withdrawn Item. This vulnerability only impacts the XMLUI. Users are advised to upgrade to version 6.4 or newer.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2022-31190

Credits & Attribution

No credits recorded in the NVD database.

References

More from DSpace

View All →
CVE-2025-53622
DSpace has path traversal vulnerability in Simple Archive Format (SAF) package import via contents file
Medium 5.2
CVE-2025-53621
DSpace vulnerable to XML External Entity (XXE) injection in import via Simple Archive Format (SAF) or import from external sources
Medium 6.9
CVE-2024-38364
DSpace Cross Site Scripting (XSS) via a deposited HTML/XML document
Low 2.6
CVE-2022-31195
Path traversal vulnerability in Simple Archive Format package import in DSpace
High 7.2
CVE-2022-31194
Path traversal vulnerabilities in DSpace JSPUI submission upload
High 8.2

Affected Vendor

Affected Software

DSpace
Vulnerable Versions:
>= 4.0, < 6.4

Timeline

Official Publish: August 1st, 2022
Last Modified: April 23rd, 2025
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weaknesses (CWE)

CWE-200

MITRE ATT&CK TTPs

T1213 Data from Information Repositories
Collection
T1005 Data from Local System
Collection
T1552 Unsecured Credentials
Credential Access
T1041 Exfiltration Over C2 Channel
Exfiltration