GitHub Advisoryadvisory · Maven

GHSA-mh83-jcw5-rjh8 XML External Entity Reference in edu.stanford.nlp:stanford-corenlp

MEDIUM Published 2022-01-14 Modified 2022-01-20 Official page ↗

Aliases: CVE-2022-0198
Ecosystem: Maven
Packages: edu.stanford.nlp:stanford-corenlp
Severity: Moderate
CVSS vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N
Weaknesses: CWE-611
Reviewed: 2022-01-14

Affected packages

• Maven edu.stanford.nlp:stanford-corenlp: <= 4.3.2 (no fix yet)

Description

The TransformXML() function makes use of SAXParser generated from a SAXParserFactory with no FEATURE_SECURE_PROCESSING set, allowing for XXE attacks.

Related

Alias · CVE (1)

CVE-2022-0198 corenlp is vulnerable to Improper Restriction of XML External Entity Reference vulnerability

Weakness · CWE (1)

CWE-611 Improper Restriction of XML External Entity Reference weakness

References