stanfordnlp/corenlp · Security
Access Control vulnerability within CoreNLP
- GHSA ID
- GHSA-x2p8-rgfm-qw3v
- CVE ID
- CVE-2021-44550
- Severity
- critical
- Published
- Updated
- CVSS
- 9.8 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS v3
- 9.8 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Description
An Incorrect Access Control vulnerability exists in CoreNLP 4.3.2 via the classifier in NERServlet.java (lines 158 and 159).
CWEs
- CWE-863 · Incorrect Authorization