XML External Entity Reference in edu.stanford.nlp:stanford-corenlp

Description

References

• nvd.nist.gov/vuln/detail/CVE-2022-0198 · ADVISORY
• stanfordnlp/corenlp commit 1f52136 · WEB
• stanfordnlp/corenlp · WEB
• huntr.dev/bounties/3d7e70fe-dddd-4b79-af62-8e058c4d5763 · WEB

Weitere Schwachstellen in edu.stanford.nlp:stanford-corenlp

• CVE-2021-44550KRITISCH 9.8An Incorrect Access Control vulnerability exists in CoreNLP 4.3.2 via the classifier in NERServlet.java (lines 158 and 159).
• CVE-2022-0239KRITISCH 9.8corenlp is vulnerable to Improper Restriction of XML External Entity Reference
• CVE-2021-3869HOCH 7.5corenlp is vulnerable to Improper Restriction of XML External Entity Reference
• CVE-2021-3878KRITISCH 9.8corenlp is vulnerable to Improper Restriction of XML External Entity Reference