Improper Restriction of XML External Entity Reference in Stanford CoreNLP

Description

References

• nvd.nist.gov/vuln/detail/CVE-2021-3878 · ADVISORY
• stanfordnlp/corenlp commit e5bbe13 · WEB
• stanfordnlp/CoreNLP · PACKAGE
• huntr.dev/bounties/a11c889b-ccff-4fea-9e29-963a23a63dd2 · WEB

edu.stanford.nlp:stanford-corenlp의 다른 취약점

• CVE-2021-44550심각 9.8An Incorrect Access Control vulnerability exists in CoreNLP 4.3.2 via the classifier in NERServlet.java (lines 158 and 159).
• CVE-2022-0239심각 9.8corenlp is vulnerable to Improper Restriction of XML External Entity Reference
• CVE-2022-0198높음 7.1corenlp is vulnerable to Improper Restriction of XML External Entity Reference
• CVE-2021-3869높음 7.5corenlp is vulnerable to Improper Restriction of XML External Entity Reference