CVEvulnerability

CVE-2017-15691

6.5 MEDIUM Published 2018-04-26 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2018-04-26
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.0 ([email protected])
6.5 MEDIUM — CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0 ([email protected])
4.0 MEDIUM — AV:N/AC:L/Au:S/C:P/I:N/A:N
Weaknesses
CWE-611

Description

In Apache uimaj prior to 2.10.2, Apache uimaj 3.0.0-xxx prior to 3.0.0-beta, Apache uima-as prior to 2.10.2, Apache uimaFIT prior to 2.4.0, Apache uimaDUCC prior to 2.2.2, this vulnerability relates to an XML external entity expansion (XXE) capability of various XML parsers. UIMA as part of its configuration and operation may read XML from various sources, which could be tainted in ways to cause inadvertent disclosure of local files or other internal content.

Affected configurations

• apache uimaj (< 2.10.2) • apache uimaj 3.0.0 • apache uima-as (< 2.10.2) • apache uimafit (< 2.4.0) • apache uimaducc (< 2.2.2)

Related

Weakness · CWE (1)

  • CWE-611 Improper Restriction of XML External Entity Reference weakness

References