Cross Site Scripting possible in DSpace JSPUI "Request a Copy" feature

An attacker submits a "Request a Copy" form on a DSpace JSPUI item page with malicious JavaScript payloads in one or more of the form fields (e.g., requester name, email, or message). Because the JSPUI does not properly escape these stored values before rendering them back to users who view the request, the injected script executes in the context of the victim's browser. The attack requires no special privileges—any anonymous user can submit the form. The vulnerability is triggered when an administrator or other user views the stored request details, leading to a stored cross-site scripting (XSS) attack.

The vulnerability resides in the JSPUI "Request a Copy" feature. The advisory states that the JSPUI does not properly escape values submitted and stored from the "Request a Copy" form. The patches provided ([patch_id=1641508], [patch_id=1641509]) are only release-version bumps (6.4 and 5.11) and do not contain any code-level fix for the XSS issue; the actual escaping fix is not shown in the supplied bundle.

The supplied patches ([patch_id=1641508], [patch_id=1641509]) are Maven release-plugin commits that only change version numbers from "-SNAPSHOT" to the release version and update the SCM tag. They contain no code changes to the JSPUI "Request a Copy" feature. Therefore, the actual fix that introduces proper output escaping for the form values is not present in the provided bundle. The advisory indicates that users should upgrade to a patched version, but the specific escaping logic is not shown here.