CVE-2022-0239 :: Enginsight Vulnerability Database

Severity

CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Atk. Vector

NETWORK

Atk. Complexity

LOW

Priv. Required

NONE

Base Score

CVSS 3.x

EPSS Score

Percentile: 78%

Vendor	Product	Version
stanford	corenlp	𝑥 ≤ 4.3.2

𝑥

= Vulnerable software versions

Known Exploits!

Common Weakness Enumeration

CWE-611 - Improper Restriction of XML External Entity Reference
The software processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.

References

https://github.com/stanfordnlp/corenlp/commit/1940ffb938dc4f3f5bc5f2a2fd8b35aabbbae3dd

https://huntr.dev/bounties/a717aec2-5646-4a5f-ade0-dadc25736ae3

https://github.com/stanfordnlp/corenlp/commit/1940ffb938dc4f3f5bc5f2a2fd8b35aabbbae3dd

https://huntr.dev/bounties/a717aec2-5646-4a5f-ade0-dadc25736ae3