Search criteria

4 vulnerabilities found for uimaducc by apache

CVE-2018-8035 (GCVE-0-2018-8035)

Vulnerability from nvd – Published: 2019-05-01 20:16 – Updated: 2024-08-05 06:46
VLAI?
Summary
This vulnerability relates to the user's browser processing of DUCC webpage input data.The javascript comprising Apache UIMA DUCC (<= 2.2.2) which runs in the user's browser does not sufficiently filter user supplied inputs, which may result in unintended execution of user supplied javascript code.
Severity ?
No CVSS data available.
CWE
  • Information Disclosure
Assigner
References
Impacted products
Vendor Product Version
Apache Apache UIMA DUCC Affected: Apache UIMA DUCC releases including and prior to 2.2.2
Create a notification for this product.
Show details on NVD website

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T06:46:12.231Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://uima.apache.org/security_report"
          },
          {
            "name": "108195",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/108195"
          },
          {
            "name": "[uima-dev] 20190606 Re: upcoming board report",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/2f49681259b375d53431605f1c557ef8a3ed0af01a488d2e1b330053%40%3Cdev.uima.apache.org%3E"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Apache UIMA DUCC",
          "vendor": "Apache",
          "versions": [
            {
              "status": "affected",
              "version": "Apache UIMA DUCC releases including and prior to 2.2.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "This vulnerability relates to the user\u0027s browser processing of DUCC webpage input data.The javascript comprising Apache UIMA DUCC (\u003c= 2.2.2) which runs in the user\u0027s browser does not sufficiently filter user supplied inputs, which may result in unintended execution of user supplied javascript code."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Information Disclosure",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2019-06-06T19:06:02",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://uima.apache.org/security_report"
        },
        {
          "name": "108195",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/108195"
        },
        {
          "name": "[uima-dev] 20190606 Re: upcoming board report",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/2f49681259b375d53431605f1c557ef8a3ed0af01a488d2e1b330053%40%3Cdev.uima.apache.org%3E"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@apache.org",
          "ID": "CVE-2018-8035",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Apache UIMA DUCC",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "Apache UIMA DUCC releases including and prior to 2.2.2"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Apache"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "This vulnerability relates to the user\u0027s browser processing of DUCC webpage input data.The javascript comprising Apache UIMA DUCC (\u003c= 2.2.2) which runs in the user\u0027s browser does not sufficiently filter user supplied inputs, which may result in unintended execution of user supplied javascript code."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Information Disclosure"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://uima.apache.org/security_report",
              "refsource": "CONFIRM",
              "url": "https://uima.apache.org/security_report"
            },
            {
              "name": "108195",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/108195"
            },
            {
              "name": "[uima-dev] 20190606 Re: upcoming board report",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/2f49681259b375d53431605f1c557ef8a3ed0af01a488d2e1b330053@%3Cdev.uima.apache.org%3E"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2018-8035",
    "datePublished": "2019-05-01T20:16:55",
    "dateReserved": "2018-03-09T00:00:00",
    "dateUpdated": "2024-08-05T06:46:12.231Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2017-15691 (GCVE-0-2017-15691)

Vulnerability from nvd – Published: 2018-04-26 17:00 – Updated: 2024-09-16 23:42
VLAI?
Summary
In Apache uimaj prior to 2.10.2, Apache uimaj 3.0.0-xxx prior to 3.0.0-beta, Apache uima-as prior to 2.10.2, Apache uimaFIT prior to 2.4.0, Apache uimaDUCC prior to 2.2.2, this vulnerability relates to an XML external entity expansion (XXE) capability of various XML parsers. UIMA as part of its configuration and operation may read XML from various sources, which could be tainted in ways to cause inadvertent disclosure of local files or other internal content.
Severity ?
No CVSS data available.
CWE
  • Information Disclosure
Assigner
References
Impacted products
Vendor Product Version
Apache Software Foundation Apache UIMA Affected: uimaj prior to 2.10.2
Affected: uimaj 3.0.0-xxx prior to 3.0.0-beta
Affected: uima-as prior to 2.10.2
Affected: uimaFIT prior to 2.4.0
Affected: uimaDUCC prior to 2.2.2
Create a notification for this product.
Show details on NVD website

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T20:04:48.435Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://uima.apache.org/security_report#CVE-2017-15691"
          },
          {
            "name": "[uima-commits] 20190501 svn commit: r1858489 - in /uima/site/trunk/uima-website: docs/security_report.html xdocs/security_report.xml",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/00407c65738e625a8cc9d732923a4ab2d8299603cc7c7e5cc2da9c79%40%3Ccommits.uima.apache.org%3E"
          },
          {
            "name": "RHSA-2019:1545",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2019:1545"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Apache UIMA",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "status": "affected",
              "version": "uimaj prior to 2.10.2"
            },
            {
              "status": "affected",
              "version": "uimaj 3.0.0-xxx prior to 3.0.0-beta"
            },
            {
              "status": "affected",
              "version": "uima-as prior to 2.10.2"
            },
            {
              "status": "affected",
              "version": "uimaFIT prior to 2.4.0"
            },
            {
              "status": "affected",
              "version": "uimaDUCC prior to 2.2.2"
            }
          ]
        }
      ],
      "datePublic": "2018-04-26T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "In Apache uimaj prior to 2.10.2, Apache uimaj 3.0.0-xxx prior to 3.0.0-beta, Apache uima-as prior to 2.10.2, Apache uimaFIT prior to 2.4.0, Apache uimaDUCC prior to 2.2.2, this vulnerability relates to an XML external entity expansion (XXE) capability of various XML parsers. UIMA as part of its configuration and operation may read XML from various sources, which could be tainted in ways to cause inadvertent disclosure of local files or other internal content."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Information Disclosure",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2019-06-18T23:06:05",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://uima.apache.org/security_report#CVE-2017-15691"
        },
        {
          "name": "[uima-commits] 20190501 svn commit: r1858489 - in /uima/site/trunk/uima-website: docs/security_report.html xdocs/security_report.xml",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/00407c65738e625a8cc9d732923a4ab2d8299603cc7c7e5cc2da9c79%40%3Ccommits.uima.apache.org%3E"
        },
        {
          "name": "RHSA-2019:1545",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2019:1545"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@apache.org",
          "DATE_PUBLIC": "2018-04-26T00:00:00",
          "ID": "CVE-2017-15691",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Apache UIMA",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "uimaj prior to 2.10.2"
                          },
                          {
                            "version_value": "uimaj 3.0.0-xxx prior to 3.0.0-beta"
                          },
                          {
                            "version_value": "uima-as prior to 2.10.2"
                          },
                          {
                            "version_value": "uimaFIT prior to 2.4.0"
                          },
                          {
                            "version_value": "uimaDUCC prior to 2.2.2"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Apache Software Foundation"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "In Apache uimaj prior to 2.10.2, Apache uimaj 3.0.0-xxx prior to 3.0.0-beta, Apache uima-as prior to 2.10.2, Apache uimaFIT prior to 2.4.0, Apache uimaDUCC prior to 2.2.2, this vulnerability relates to an XML external entity expansion (XXE) capability of various XML parsers. UIMA as part of its configuration and operation may read XML from various sources, which could be tainted in ways to cause inadvertent disclosure of local files or other internal content."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Information Disclosure"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://uima.apache.org/security_report#CVE-2017-15691",
              "refsource": "CONFIRM",
              "url": "https://uima.apache.org/security_report#CVE-2017-15691"
            },
            {
              "name": "[uima-commits] 20190501 svn commit: r1858489 - in /uima/site/trunk/uima-website: docs/security_report.html xdocs/security_report.xml",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/00407c65738e625a8cc9d732923a4ab2d8299603cc7c7e5cc2da9c79@%3Ccommits.uima.apache.org%3E"
            },
            {
              "name": "RHSA-2019:1545",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2019:1545"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2017-15691",
    "datePublished": "2018-04-26T17:00:00Z",
    "dateReserved": "2017-10-21T00:00:00",
    "dateUpdated": "2024-09-16T23:42:23.280Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2018-8035 (GCVE-0-2018-8035)

Vulnerability from cvelistv5 – Published: 2019-05-01 20:16 – Updated: 2024-08-05 06:46
VLAI?
Summary
This vulnerability relates to the user's browser processing of DUCC webpage input data.The javascript comprising Apache UIMA DUCC (<= 2.2.2) which runs in the user's browser does not sufficiently filter user supplied inputs, which may result in unintended execution of user supplied javascript code.
Severity ?
No CVSS data available.
CWE
  • Information Disclosure
Assigner
References
Impacted products
Vendor Product Version
Apache Apache UIMA DUCC Affected: Apache UIMA DUCC releases including and prior to 2.2.2
Create a notification for this product.
Show details on NVD website

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T06:46:12.231Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://uima.apache.org/security_report"
          },
          {
            "name": "108195",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/108195"
          },
          {
            "name": "[uima-dev] 20190606 Re: upcoming board report",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/2f49681259b375d53431605f1c557ef8a3ed0af01a488d2e1b330053%40%3Cdev.uima.apache.org%3E"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Apache UIMA DUCC",
          "vendor": "Apache",
          "versions": [
            {
              "status": "affected",
              "version": "Apache UIMA DUCC releases including and prior to 2.2.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "This vulnerability relates to the user\u0027s browser processing of DUCC webpage input data.The javascript comprising Apache UIMA DUCC (\u003c= 2.2.2) which runs in the user\u0027s browser does not sufficiently filter user supplied inputs, which may result in unintended execution of user supplied javascript code."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Information Disclosure",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2019-06-06T19:06:02",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://uima.apache.org/security_report"
        },
        {
          "name": "108195",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/108195"
        },
        {
          "name": "[uima-dev] 20190606 Re: upcoming board report",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/2f49681259b375d53431605f1c557ef8a3ed0af01a488d2e1b330053%40%3Cdev.uima.apache.org%3E"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@apache.org",
          "ID": "CVE-2018-8035",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Apache UIMA DUCC",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "Apache UIMA DUCC releases including and prior to 2.2.2"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Apache"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "This vulnerability relates to the user\u0027s browser processing of DUCC webpage input data.The javascript comprising Apache UIMA DUCC (\u003c= 2.2.2) which runs in the user\u0027s browser does not sufficiently filter user supplied inputs, which may result in unintended execution of user supplied javascript code."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Information Disclosure"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://uima.apache.org/security_report",
              "refsource": "CONFIRM",
              "url": "https://uima.apache.org/security_report"
            },
            {
              "name": "108195",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/108195"
            },
            {
              "name": "[uima-dev] 20190606 Re: upcoming board report",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/2f49681259b375d53431605f1c557ef8a3ed0af01a488d2e1b330053@%3Cdev.uima.apache.org%3E"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2018-8035",
    "datePublished": "2019-05-01T20:16:55",
    "dateReserved": "2018-03-09T00:00:00",
    "dateUpdated": "2024-08-05T06:46:12.231Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2017-15691 (GCVE-0-2017-15691)

Vulnerability from cvelistv5 – Published: 2018-04-26 17:00 – Updated: 2024-09-16 23:42
VLAI?
Summary
In Apache uimaj prior to 2.10.2, Apache uimaj 3.0.0-xxx prior to 3.0.0-beta, Apache uima-as prior to 2.10.2, Apache uimaFIT prior to 2.4.0, Apache uimaDUCC prior to 2.2.2, this vulnerability relates to an XML external entity expansion (XXE) capability of various XML parsers. UIMA as part of its configuration and operation may read XML from various sources, which could be tainted in ways to cause inadvertent disclosure of local files or other internal content.
Severity ?
No CVSS data available.
CWE
  • Information Disclosure
Assigner
References
Impacted products
Vendor Product Version
Apache Software Foundation Apache UIMA Affected: uimaj prior to 2.10.2
Affected: uimaj 3.0.0-xxx prior to 3.0.0-beta
Affected: uima-as prior to 2.10.2
Affected: uimaFIT prior to 2.4.0
Affected: uimaDUCC prior to 2.2.2
Create a notification for this product.
Show details on NVD website

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T20:04:48.435Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://uima.apache.org/security_report#CVE-2017-15691"
          },
          {
            "name": "[uima-commits] 20190501 svn commit: r1858489 - in /uima/site/trunk/uima-website: docs/security_report.html xdocs/security_report.xml",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/00407c65738e625a8cc9d732923a4ab2d8299603cc7c7e5cc2da9c79%40%3Ccommits.uima.apache.org%3E"
          },
          {
            "name": "RHSA-2019:1545",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2019:1545"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Apache UIMA",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "status": "affected",
              "version": "uimaj prior to 2.10.2"
            },
            {
              "status": "affected",
              "version": "uimaj 3.0.0-xxx prior to 3.0.0-beta"
            },
            {
              "status": "affected",
              "version": "uima-as prior to 2.10.2"
            },
            {
              "status": "affected",
              "version": "uimaFIT prior to 2.4.0"
            },
            {
              "status": "affected",
              "version": "uimaDUCC prior to 2.2.2"
            }
          ]
        }
      ],
      "datePublic": "2018-04-26T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "In Apache uimaj prior to 2.10.2, Apache uimaj 3.0.0-xxx prior to 3.0.0-beta, Apache uima-as prior to 2.10.2, Apache uimaFIT prior to 2.4.0, Apache uimaDUCC prior to 2.2.2, this vulnerability relates to an XML external entity expansion (XXE) capability of various XML parsers. UIMA as part of its configuration and operation may read XML from various sources, which could be tainted in ways to cause inadvertent disclosure of local files or other internal content."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Information Disclosure",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2019-06-18T23:06:05",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://uima.apache.org/security_report#CVE-2017-15691"
        },
        {
          "name": "[uima-commits] 20190501 svn commit: r1858489 - in /uima/site/trunk/uima-website: docs/security_report.html xdocs/security_report.xml",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/00407c65738e625a8cc9d732923a4ab2d8299603cc7c7e5cc2da9c79%40%3Ccommits.uima.apache.org%3E"
        },
        {
          "name": "RHSA-2019:1545",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2019:1545"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@apache.org",
          "DATE_PUBLIC": "2018-04-26T00:00:00",
          "ID": "CVE-2017-15691",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Apache UIMA",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "uimaj prior to 2.10.2"
                          },
                          {
                            "version_value": "uimaj 3.0.0-xxx prior to 3.0.0-beta"
                          },
                          {
                            "version_value": "uima-as prior to 2.10.2"
                          },
                          {
                            "version_value": "uimaFIT prior to 2.4.0"
                          },
                          {
                            "version_value": "uimaDUCC prior to 2.2.2"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Apache Software Foundation"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "In Apache uimaj prior to 2.10.2, Apache uimaj 3.0.0-xxx prior to 3.0.0-beta, Apache uima-as prior to 2.10.2, Apache uimaFIT prior to 2.4.0, Apache uimaDUCC prior to 2.2.2, this vulnerability relates to an XML external entity expansion (XXE) capability of various XML parsers. UIMA as part of its configuration and operation may read XML from various sources, which could be tainted in ways to cause inadvertent disclosure of local files or other internal content."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Information Disclosure"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://uima.apache.org/security_report#CVE-2017-15691",
              "refsource": "CONFIRM",
              "url": "https://uima.apache.org/security_report#CVE-2017-15691"
            },
            {
              "name": "[uima-commits] 20190501 svn commit: r1858489 - in /uima/site/trunk/uima-website: docs/security_report.html xdocs/security_report.xml",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/00407c65738e625a8cc9d732923a4ab2d8299603cc7c7e5cc2da9c79@%3Ccommits.uima.apache.org%3E"
            },
            {
              "name": "RHSA-2019:1545",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2019:1545"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2017-15691",
    "datePublished": "2018-04-26T17:00:00Z",
    "dateReserved": "2017-10-21T00:00:00",
    "dateUpdated": "2024-09-16T23:42:23.280Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}