CVE-2023-22665: Apache Jena: Exposure of arbitrary execution in script engine expressions.
Published Apr 25, 2023
·Updated
There is insufficient checking of user queries in Apache Jena versions 4.7.0 and earlier, when invoking custom scripts. It allows a remote user to execute arbitrary javascript via a SPARQL query.
Affected Software
5 affected componentsFixes available
Apache Jena<4.8.0
maven/org.apache.jena:jena<4.8.0
4.8.0
Apache Jena>=3.7.0<=4.8.0
IBM Engineering Requirements Management DOORS and DOORS Web Access<=9.7.2.1 - 9.7.2.11
IBM Engineering Requirements Management DOORS and DOORS Web Access<=9.6.1.1 - 9.6.1.13
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/org.apache.jena:jenato a version that resolves this vulnerability.Fixed in 4.8.0
Event History
Apr 25, 2023
CVE Published
via MITRE·06:44 AM
Data Sourced
via MITRE·06:44 AM
DescriptionWeakness
Advisory Published
09:30 AM
Jul 6, 2026
Data Sourced
via IBM·12:00 AM
DescriptionAffected Software
Frequently Asked Questions
1
What is the vulnerability ID?
The vulnerability ID is CVE-2023-22665.
2
What is the severity of CVE-2023-22665?
The severity of CVE-2023-22665 is medium with a severity value of 5.4.
3
What is the affected software?
The affected software is Apache Jena versions 4.7.0 and earlier.
4
How can a remote user exploit CVE-2023-22665?
A remote user can exploit CVE-2023-22665 by executing arbitrary JavaScript via a SPARQL query.
5
How can I fix CVE-2023-22665?
You can fix CVE-2023-22665 by upgrading to Apache Jena version 4.8.0 or later.