Cross-site Scripting in Apache UIMA

Also known as GHSA-vm59-329q-p468

Published 7 y ago 2019-05-01 · modified 4 mo ago 2026-06-17 · JSON

CVSS

6.1

v3.0 · NVD

CISA KEV

not known exploited

EPSS

4.9%

percentile 92%

Public exploits

none known

This vulnerability relates to the user's browser processing of DUCC webpage input data.The javascript comprising Apache UIMA DUCC (<= 2.2.2) which runs in the user's browser does not sufficiently filter user supplied inputs, which may result in unintended execution of user supplied javascript code.

Exploit prediction (EPSS)

4.88% probability of exploitation in the next 30 days, higher than 92% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
NVD	3.0	6.1	`CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N`
NVD	2.0	4.3	`AV:N/AC:M/Au:N/C:N/I:P/A:N`
GitHub	3.0	6.1	`CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N`

Affected packages

Ecosystem	Package	Affected	Fixed in
maven	`org.apache.uima:uima-ducc-web`	<3.0.0	3.0.0

Affected products

Apache Apache UIMA DUCC

Classification

Weakness

CWE-79 Improper Neutralization of Input During Web Page Generation

References

uima.apache.org /security_report · x_refsource_CONFIRM, x_transferred
securityfocus.com /bid/108195 · vdb-entry, x_refsource_BID, x_transferred
lists.apache.org /thread.html/2f49681259b375d53431605f1c557ef8a3ed0af01a488d2e1b330053%40%3Cdev.uima.apache · mailing-list, x_refsource_MLIST, x_transferred
nvd.nist.gov /vuln/detail/CVE-2018-8035 · advisory
lists.apache.org /thread.html/2f49681259b375d53431605f1c557ef8a3ed0af01a488d2e1b330053@%3Cdev.uima.apache.o · web

Sources

CVE List: CVE-2018-8035
GitHub Advisory: GHSA-vm59-329q-p468
NVD: CVE-2018-8035

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.

Summary