PT-2022-12160 · Corenlp · Corenlp

Published 2022-02-23 · Updated 2022-07-12 · CVE-2021-44550

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions CoreNLP version 4.3.2

Description An issue exists due to incorrect access control in the classifier within NERServlet.java, specifically at lines 158 and 159.

Recommendations For CoreNLP version 4.3.2, consider restricting access to the classifier in NERServlet.java as a temporary workaround until a patch is available.

Exploit

Fix

Special Elements Injection

Incorrect Authorization

Weakness Enumeration

CWE-74

CWE-863

Related Identifiers

CVE-2021-44550

GHSA-X2P8-RGFM-QW3V

Affected Products

Corenlp

References · 7

• 🔥 https://github.com/stanfordnlp/CoreNLP/issues/1222 · Exploit
• https://osv.dev/vulnerability/GHSA-x2p8-rgfm-qw3v · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-44550 · Security Note
• https://osv.dev/vulnerability/CVE-2021-44550 · Vendor Advisory
• https://github.com/stanfordnlp/CoreNLP · Note
• https://github.com/stanfordnlp/CoreNLP/commit/5ee097dbede547023e88f60ed3f430ff09398b87 · Note
• https://t.me/cvenotify/27277 · Telegram Post