title: Apache Jena: Exposure of arbitrary execution in script engine expressions.
description: There is insufficient checking of user queries in Apache Jena versions 4.7.0 and earlier, when invoking custom scripts. It allows a remote user to execute arbitrary javascript via a SPARQL query.
problem types: CWE-917 Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')
affected:
{
defaultStatus: unaffected
product: Apache Jena
vendor: Apache Software Foundation
versions:
lessThanOrEqual: 4.7.0, status: affected, version: 0, versionType: semver
}
metrics:
other: [
content: {'text': 'important'}
type: Textual description of severity
]
workarounds: Users not using custom scripted functions are advised to run Java17 or later with no script engine added to the deployment.