GHSA-mh83-jcw5-rjh8

ghsaUSosv

XML External Entity Reference in edu.stanford.nlp:stanford-corenlp

view advisory published 2022-01-14Licence: CC-BY-4.0

The TransformXML() function makes use of SAXParser generated from a SAXParserFactory with no FEATURE_SECURE_PROCESSING set, allowing for XXE attacks.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2022-0198US	high7.1	0.74% (54th)	—	2022-01-13
corenlp is vulnerable to Improper Restriction of XML External Entity Reference

External citations — patches, advisories, analysis.

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.