corenlp is vulnerable to Improper Restriction of XML External Entity Reference

Description

References

• nvd.nist.gov/vuln/detail/CVE-2022-0239 · ADVISORY
• stanfordnlp/CoreNLP#1242 · WEB
• stanfordnlp/CoreNLP commit f44e693 · WEB
• stanfordnlp/corenlp commit 1940ffb · WEB
• stanfordnlp/corenlp · PACKAGE
• huntr.dev/bounties/a717aec2-5646-4a5f-ade0-dadc25736ae3 · WEB
• security.snyk.io/vuln/SNYK-JAVA-EDUSTANFORDNLP-2342121 · WEB

edu.stanford.nlp:stanford-corenlp 的其他漏洞

• CVE-2021-44550严重 9.8An Incorrect Access Control vulnerability exists in CoreNLP 4.3.2 via the classifier in NERServlet.java (lines 158 and 159).
• CVE-2022-0198高危 7.1corenlp is vulnerable to Improper Restriction of XML External Entity Reference
• CVE-2021-3869高危 7.5corenlp is vulnerable to Improper Restriction of XML External Entity Reference
• CVE-2021-3878严重 9.8corenlp is vulnerable to Improper Restriction of XML External Entity Reference