GitHub Advisoryadvisory · Maven

GHSA-x2p8-rgfm-qw3v Access Control vulnerability within CoreNLP

CRITICAL Published 2022-02-25 Modified 2022-03-03 Official page ↗

Aliases: CVE-2021-44550
Ecosystem: Maven
Packages: edu.stanford.nlp:stanford-corenlp
Severity: Critical
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses: CWE-863
Reviewed: 2022-02-25

Affected packages

• Maven edu.stanford.nlp:stanford-corenlp: < 4.4.0 → fixed in 4.4.0

Description

An Incorrect Access Control vulnerability exists in CoreNLP 4.3.2 via the classifier in NERServlet.java (lines 158 and 159).

Related

Alias · CVE (1)

CVE-2021-44550 An Incorrect Access Control vulnerability exists in CoreNLP 4.3.2 via the classifier in NERServlet.java (lines 158 and 159). vulnerability

Weakness · CWE (1)

CWE-863 Incorrect Authorization weakness

References