CVE-2023-22665: vulnerability in Apache Jena
Apache Jena: Exposure of arbitrary execution in script engine expressions.
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
3Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackepss 1.3%
There is insufficient checking of user queries in Apache Jena versions 4.7.0 and earlier, when invoking custom scripts. It allows a remote user to execute arbitrary javascript via a SPARQL query.
Affected products
Apache Software Foundation · Apache JenaRelated CVEs — Apache Jena
In the same product, most dangerous first.
CVE-2021-39239—XML External Entity (XXE) vulnerabilityEPSS 4.3%CVE-2022-28890—Processing external DTDsEPSS 2.7%CVE-2025-49656HIGHApache Jena: Administrative users can create files outside the server directory space via the admin UIEPSS 1.6%CVE-2023-32200HIGHApache Jena: Exposure of execution in script engine expressions.EPSS 1.5%CVE-2025-50151HIGHApache Jena: Configuration files uploaded by administrative users are not check properlyEPSS 1.1%