CVE-2022-0239 Improper Restriction of XML External Entity Reference in stanfordnlp/corenlp

2022-01-1706:15:11

CWE-611

@huntrdev

github.com

corenlp

xml

vulnerability

external entity

CVSS3

4.7

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

AI Score

6.7

Confidence

Low

SSVC

Exploitation

poc

Automatable

yes

Technical Impact

total

JSON

corenlp is vulnerable to Improper Restriction of XML External Entity Reference

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:a:stanford:corenlp:*:*:*:*:*:*:*:*"
    ],
    "vendor": "stanford",
    "product": "corenlp",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "lessThan": "4.3.3",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unknown"
  }
]