Detections
Analytics

SCA: security update for org.dspace:dspace-server-webapp (GHSA-94cc-xjxr-pwvf)

low Tenable Self-Hosted Container Security Plugin ID 413020

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - DSpace is an open source software is a turnkey repository application used by more than 2,000
 organizations and institutions worldwide to provide durable access to digital resources. In DSpace 7.0
 through 7.6.1, when an HTML, XML or JavaScript Bitstream is downloaded, the user's browser may execute any
 embedded JavaScript. If that embedded JavaScript is malicious, there is a risk of an XSS attack. This
 vulnerability has been patched in version 7.6.2. (CVE-2024-38364)

See Also

https://github.com/advisories/GHSA-94cc-xjxr-pwvf

Plugin Details

Severity: Low

ID: 413020

Version: Revision 1.5

Type: Local

Family: SCA Checks

Published: 1/23/2025

Updated: 6/1/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 1.2

Percentile: 0.01

Vendor

Vendor Severity: Low

CVSS v2

Risk Factor: Low

Base Score: 2.1

Temporal Score: 1.6

Vector: CVSS2#AV:N/AC:H/Au:S/C:N/I:N/A:P

CVSS Score Source: CVE-2024-38364

CVSS v3

Risk Factor: Low

Base Score: 2.6

Temporal Score: 2.3

Vector: CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:L

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 6/25/2024

Vulnerability Publication Date: 6/25/2024

Reference Information

CVE: CVE-2024-38364

cwe: CWE-79