CVE-2017-15691
MEDIUMApache UIMA < 2.10.2 - XML External Entity Injection
Title source: llmDescription
In Apache uimaj prior to 2.10.2, Apache uimaj 3.0.0-xxx prior to 3.0.0-beta, Apache uima-as prior to 2.10.2, Apache uimaFIT prior to 2.4.0, Apache uimaDUCC prior to 2.2.2, this vulnerability relates to an XML external entity expansion (XXE) capability of various XML parsers. UIMA as part of its configuration and operation may read XML from various sources, which could be tainted in ways to cause inadvertent disclosure of local files or other internal content.
References (3)
Core 3
Core References
Vendor Advisory x_refsource_confirm
https://uima.apache.org/security_report#CVE-2017-15691
Mailing List mailing-list
x_refsource_mlist
https://lists.apache.org/thread.html/00407c65738e625a8cc9d732923a4ab2d8299603cc7c7e5cc2da9c79%40%3Ccommits.uima.apache.org%3E
Vendor Advisory vendor-advisory
x_refsource_redhat
https://access.redhat.com/errata/RHSA-2019:1545
Scores
CVSS v3
6.5
EPSS
0.0078
EPSS Percentile
73.9%
Attack Vector
NETWORK
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Details
CWE
CWE-611
Status
published
Products (8)
apache/uima-as
< 2.10.2
apache/uimaducc
< 2.2.2
apache/uimafit
< 2.4.0
apache/uimaj
3.0.0 (3 CPE variants)
apache/uimaj
< 2.10.2
org.apache.uima/uimafit-core
0 - 2.4.0Maven
org.apache.uima/uimaj-as-core
0 - 2.10.2Maven
org.apache.uima/uimaj-core
0 - 2.10.2Maven
Published
Apr 26, 2018
Tracked Since
Feb 18, 2026