6.5

CVE-2017-15691

In Apache uimaj prior to 2.10.2, Apache uimaj 3.0.0-xxx prior to 3.0.0-beta, Apache uima-as prior to 2.10.2, Apache uimaFIT prior to 2.4.0, Apache uimaDUCC prior to 2.2.2, this vulnerability relates to an XML external entity expansion (XXE) capability of various XML parsers. UIMA as part of its configuration and operation may read XML from various sources, which could be tainted in ways to cause inadvertent disclosure of local files or other internal content.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Apache ≫ Uimaj Version < 2.10.2
Apache ≫ Uimaj Version 3.0.0
Apache ≫ Uimaj Version 3.0.0 Update alpha
Apache ≫ Uimaj Version 3.0.0 Update alpha2
Apache ≫ Uima-as Version < 2.10.2
Apache ≫ Uimafit Version < 2.4.0
Apache ≫ Uimaducc Version < 2.2.2
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 9.02% 0.946
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 6.5 2.8 3.6
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
NIST 4 8 2.9
AV:N/AC:L/Au:S/C:P/I:N/A:N
CWE-611 Improper Restriction of XML External Entity Reference

The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.

https://access.redhat.com/errata/RHSA-2019:1545
https://lists.apache.org/thread.html/00407c65738e625a8cc9d732923a4ab2d8299603cc7c7e5cc2da9c79%40%3Ccommits.uima.apache.org%3E
https://uima.apache.org/security_report#CVE-2017-15691
Vendor Advisory