GitHub Advisoryadvisory · Maven

GHSA-wp2f-hrg2-3r5m Improper Restriction of XML External Entity Reference in Apache uimaj

MEDIUM Published 2022-05-14 Modified 2022-07-01 Official page ↗
Aliases
CVE-2017-15691
Ecosystem
Maven
Packages
org.apache.uima:uimafit-core, org.apache.uima:uimaj-core, org.apache.uima:uimaj-as-core
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-611
Reviewed
2022-07-01

Affected packages

• Maven org.apache.uima:uimafit-core: < 2.4.0 → fixed in 2.4.0 • Maven org.apache.uima:uimaj-core: < 2.10.2 → fixed in 2.10.2 • Maven org.apache.uima:uimaj-core: >= 3.0.0-alpha, < 3.0.0-beta → fixed in 3.0.0-beta • Maven org.apache.uima:uimaj-as-core: < 2.10.2 → fixed in 2.10.2

Description

In Apache uimaj prior to 2.10.2, Apache uimaj 3.0.0-xxx prior to 3.0.0-beta, Apache uima-as prior to 2.10.2, Apache uimaFIT prior to 2.4.0, Apache uimaDUCC prior to 2.2.2, this vulnerability relates to an XML external entity expansion (XXE) capability of various XML parsers. UIMA as part of its configuration and operation may read XML from various sources, which could be tainted in ways to cause inadvertent disclosure of local files or other internal content.

Related

Alias · CVE (1)

  • CVE-2017-15691 In Apache uimaj prior to 2.10.2, Apache uimaj 3.0.0-xxx prior to 3.0.0-beta, Apache uima-as prior to 2.10.2, Apache uimaFIT prior to 2.4.0,… vulnerability

Weakness · CWE (1)

  • CWE-611 Improper Restriction of XML External Entity Reference weakness

References