Lucene search
Veracode Vulnerability DatabaseVERACODE:32512HistoryOct 18, 2021 - 5:55 a.m.
XML External Entity (XXE) Injection
2021-10-1805:55:11
Veracode Vulnerability Database
sca.analysiscenter.veracode.com
3
0.003 Low
EPSS
Percentile
66.0%
stanford-corenlp is vulnerable to XML external entity (XXE) injection attacks. The vulnerability exists because the readDocument() function in ‘DomReader.java’ doesn’t disable access to external entities by default, allowing a malicious attacker to provide a crafted XML file and expose contents of local files to the remote server.
| CPE | Name | Operator | Version |
|---|---|---|---|
| stanford corenlp | le | 4.3.0 | |
| stanford corenlp | le | 4.3.0 |
Related
osv
osv
Improper Restriction of XML External Entity Reference in Stanford CoreNLP
2022-05-24 19:17:42
cnvd
cnvd
Stanford corenlp has an unspecified vulnerability
2021-10-19 00:00:00
github
github
Improper Restriction of XML External Entity Reference in Stanford CoreNLP
2022-05-24 19:17:42
prion
prion
Xxe
2021-10-15 14:15:00
cve
cve
CVE-2021-3878
2021-10-15 14:15:07
huntr
huntr
in stanfordnlp/corenlp
2021-10-11 22:54:07
cvelist
cvelist
nvd
nvd
CVE-2021-3878
2021-10-15 14:15:07
