title: Apache Jena: Exposure of execution in script engine expressions.
description: There is insufficient restrictions of called script functions in Apache Jena
versions 4.8.0 and earlier. It allows a
remote user to execute javascript via a SPARQL query.
This issue affects Apache Jena: from 3.7.0 through 4.8.0.
problem types: CWE-917 Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')
affected:
{
defaultStatus: unaffected
product: Apache Jena
vendor: Apache Software Foundation
versions:
lessThanOrEqual: 4.8.0, status: affected, version: 3.7.0, versionType: semver
}
metrics:
other: [
content: {'text': 'important'}
type: Textual description of severity
]