CVE-2023-22665: There is insufficient checking of user queries in Apache Jena versions 4.7.0 and earlier, when invoking custom scripts. It allows a remote user to execute…

PriorityP429medium5.4CVSS 3.1

AVNACLPRLUIRSCCLILAN

EPSS

1.32%

67.6th percentile

There is insufficient checking of user queries in Apache Jena versions 4.7.0 and earlier, when invoking custom scripts. It allows a remote user to execute arbitrary javascript via a SPARQL query.

Affected

3 ranges

Vendor	Product	Version range	Fixed in
apache	jena	3.7.0 – 4.8.0	—
apache_software_foundation	apache_jena	<= 4.7.0	—
debian	apache-jena	< apache-jena 4.9.0-1 (forky)	apache-jena 4.9.0-1 (forky)

CVSS provenance

nvdv3.15.4MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

osv5.4MEDIUM

vendor_debian5.4MEDIUM

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.