CVE-2018-8035

6.1MEDIUM

Key Information:

Vendor
Apache
Status
Apache Uima Ducc
Vendor
CVE Published:
1 May 2019

Summary

This vulnerability relates to the user's browser processing of DUCC webpage input data.The javascript comprising Apache UIMA DUCC (<= 2.2.2) which runs in the user's browser does not sufficiently filter user supplied inputs, which may result in unintended execution of user supplied javascript code.

Affected Version(s)

Apache UIMA DUCC Apache UIMA DUCC releases including and prior to 2.2.2

References

https://uima.apache.org/security_report
x_refsource_CONFIRM
http://www.securityfocus.com/bid/108195
vdb-entryx_refsource_BID
https://lists.apache.org/thread.html/2f49681259b375d53431...
mailing-listx_refsource_MLIST

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.