Low severity · published Jun 25, 2024
CVE-2024-38364
DSpace Cross Site Scripting (XSS) via a deposited HTML/XML document
2.6
CVSS
0.4%
EPSS
No
On KEV
Description
DSpace is an open source software is a turnkey repository application used by more than 2,000 organizations and institutions worldwide to provide durable access to digital resources. In DSpace 7.0 through 7.6.1, when an HTML, XML or JavaScript Bitstream is downloaded, the user's browser may execute any embedded JavaScript. If that embedded JavaScript is malicious, there is a risk of an XSS attack. This vulnerability has been patched in version 7.6.2.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:L
Attack vector
Network
Complexity
High
Privileges
Low
User interaction
Required
Confidentiality
None
Integrity
None
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 33% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DS
DSpace · DSpace
>= 7.0, < 7.6.2 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-38364
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-38364
github.com
https://github.com/DSpace/DSpace/commit/f1059b4340857cca3dc4c45b1ebbadce6bb61c0b
github.com
https://github.com/DSpace/DSpace/pull/8891
github.com
https://github.com/DSpace/DSpace/pull/9638
github.com
https://github.com/DSpace/DSpace/security/advisories/GHSA-94cc-xjxr-pwvf
More from DSpace
8.0
CVE-2026-49832
DSpace: Remote Code Execution (RCE) possible in Velocity Templates used by LDN
7.2
CVE-2022-31195
Path traversal vulnerability in Simple Archive Format package import in DSpace
7.2
CVE-2022-31194
Path traversal vulnerabilities in DSpace JSPUI submission upload
6.9
CVE-2025-53621
DSpace vulnerable to XML External Entity (XXE) injection in import via Simple Archive Format (SAF) or import from external sources
6.1
CVE-2022-31192
Cross Site Scripting possible in DSpace JSPUI "Request a Copy" feature