Apache UIMA DUCC: DUCC (EOL) allows RCE

CVE-2023-28935

Summary

An improper neutralization of special elements used in a command vulnerability exists within the Apache UIMA's Distributed UIMA Cluster Computing (DUCC) module. An authenticated user with permissions to alter core entities could exploit this flaw to execute arbitrary commands as the system user that runs the web process. It's crucial to note that this module is retired, and Apache does not intend to provide any patches, making affected systems particularly vulnerable.

References