CVE-2023-32200
highpriority · track · 36EPSS 0.015 · 74 %ileEUUSEPSS · scored 2026-10-28
There is insufficient restrictions of called script functions in Apache Jena versions 4.8.0 and earlier. It allows a remote user to execute javascript via a SPARQL query. This issue affects Apache Jena: from 3.7.0 through 4.8.0.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (3)
Products and version ranges known to be affected.
advisories (1)
Vendor and ecosystem advisories describing this.
- GHSA-j927-w6g7-7c7wApache Jena Expression Language Injection vulnerability2023-07-12ghsa · osvUS
There is insufficient restrictions of called script functions in Apache Jena versions 4.8.0 and earlier. It allows a remote user to execute javascript via a SPARQL query. This issue affects Apache Jena from 3.7.0 through 4.8.0.
also known as (3)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (7)
External citations — patches, advisories, analysis.
- https://cxsecurity.com/cveshow/CVE-2023-32200/cnnvd
- https://lists.apache.org/thread/7hg0t2kws3fyr75dl7lll8389xzzc46zcnnvd
- https://www.cve.org/CVERecord?id=CVE-2023-22665cnnvd
- https://lists.apache.org/thread/7hg0t2kws3fyr75dl7lll8389xzzc46zenisa_euvd
- https://www.cve.org/CVERecord?id=CVE-2023-22665enisa_euvd
- https://lists.apache.org/thread/7hg0t2kws3fyr75dl7lll8389xzzc46zMailing ListThird Party Advisorynvd
- https://www.cve.org/CVERecord?id=CVE-2023-22665Third Party Advisorynvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan