XML external entity injection in Apache UIMA
Priority MEDIUM 40CWE-611Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Partial Red Hat: 1 fixed, 1 without a fix
Attack profile from CVSS 3.0 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-611 and the CVSS impact.
Summary
In Apache uimaj prior to 2.10.2, Apache uimaj 3.0.0-xxx prior to 3.0.0-beta, Apache uima-as prior to 2.10.2, Apache uimaFIT prior to 2.4.0, Apache uimaDUCC prior to 2.2.2, this vulnerability relates to an XML external entity expansion (XXE) capability of various XML parsers. UIMA as part of its configuration and operation may read XML from various sources, which could be tainted in ways to cause inadvertent disclosure of local files or other internal content.
Why it matters now
EPSS 0.08855 95th percentileScored 2026-11-07
Fix Partial org.apache.uima:uimafit-core (Maven): 2.4.0org.apache.uima:uimaj-core (Maven): 2.10.2, 3.0.0-beta+1 more productRed Hat: 1 advisoryRed Hat: 1 fixed, 1 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Apache | Apache UIMA | uimaj prior to 2.10.2; uimaj 3.0.0-xxx prior to 3.0.0-beta; uima-as prior to 2.10.2; uimaFIT prior to 2.4.0; uimaDUCC prior to 2.2.2 | — | No fix listed | CNA |
| — | org.apache.uima:uimafit-core (Maven) | before 2.4.0 | 2.4.0 | Patch available | GHSA-wp2f-hrg2-3r5m |
| — | org.apache.uima:uimaj-core (Maven) | before 2.10.2 | 2.10.2 | Patch available | GHSA-wp2f-hrg2-3r5m |
| — | org.apache.uima:uimaj-core (Maven) | 3.0.0-alpha to before 3.0.0-beta | 3.0.0-beta | Patch available | GHSA-wp2f-hrg2-3r5m |
| — | org.apache.uima:uimaj-as-core (Maven) | before 2.10.2 | 2.10.2 | Patch available | GHSA-wp2f-hrg2-3r5m |
- Apache UIMA VendorApache Affected uimaj prior to 2.10.2; uimaj 3.0.0-xxx prior to 3.0.0-beta; uima-as prior to 2.10.2; uimaFIT prior to 2.4.0; uimaDUCC prior to 2.2.2 Fixed in — No fix listed CNA
- org.apache.uima:uimafit-core (Maven) Vendor— Affected before 2.4.0 Fixed in 2.4.0 Patch available GHSA-wp2f-hrg2-3r5m
- org.apache.uima:uimaj-core (Maven) Vendor— Affected before 2.10.2 Fixed in 2.10.2 Patch available GHSA-wp2f-hrg2-3r5m
- org.apache.uima:uimaj-core (Maven) Vendor— Affected 3.0.0-alpha to before 3.0.0-beta Fixed in 3.0.0-beta Patch available GHSA-wp2f-hrg2-3r5m
- org.apache.uima:uimaj-as-core (Maven) Vendor— Affected before 2.10.2 Fixed in 2.10.2 Patch available GHSA-wp2f-hrg2-3r5m
CPE configurations NVD · 7
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:apache:uimaj:*:*:*:*:*:*:*:* | before 2.10.2 | Vulnerable | Apache |
| cpe:2.3:a:apache:uimaj:3.0.0:*:*:*:*:*:*:* | 3.0.0 | Vulnerable | Apache |
| cpe:2.3:a:apache:uimaj:3.0.0:alpha:*:*:*:*:*:* | 3.0.0 alpha | Vulnerable | Apache |
| cpe:2.3:a:apache:uimaj:3.0.0:alpha2:*:*:*:*:*:* | 3.0.0 alpha2 | Vulnerable | Apache |
| cpe:2.3:a:apache:uima-as:*:*:*:*:*:*:*:* | before 2.10.2 | Vulnerable | Apache |
| cpe:2.3:a:apache:uimafit:*:*:*:*:*:*:*:* | before 2.4.0 | Vulnerable | Apache |
| cpe:2.3:a:apache:uimaducc:*:*:*:*:*:*:*:* | before 2.2.2 | Vulnerable | Apache |
- cpe:2.3:a:apache:uimaj:*:*:*:*:*:*:*:* Versions before 2.10.2 Vulnerable ·Apache
- cpe:2.3:a:apache:uimaj:3.0.0:*:*:*:*:*:*:* Versions 3.0.0 Vulnerable ·Apache
- cpe:2.3:a:apache:uimaj:3.0.0:alpha:*:*:*:*:*:* Versions 3.0.0 alpha Vulnerable ·Apache
- cpe:2.3:a:apache:uimaj:3.0.0:alpha2:*:*:*:*:*:* Versions 3.0.0 alpha2 Vulnerable ·Apache
- cpe:2.3:a:apache:uima-as:*:*:*:*:*:*:*:* Versions before 2.10.2 Vulnerable ·Apache
- cpe:2.3:a:apache:uimafit:*:*:*:*:*:*:*:* Versions before 2.4.0 Vulnerable ·Apache
- cpe:2.3:a:apache:uimaducc:*:*:*:*:*:*:*:* Versions before 2.2.2 Vulnerable ·Apache
Remediation
- Fix · GHSA-wp2f-hrg2-3r5m org.apache.uima:uimafit-core (Maven) Fixed in 2.4.0 Advisory →
- Fix · GHSA-wp2f-hrg2-3r5m org.apache.uima:uimaj-core (Maven) Fixed in 2.10.2 Advisory →
- Fix · GHSA-wp2f-hrg2-3r5m org.apache.uima:uimaj-core (Maven) Fixed in 3.0.0-beta Advisory →
- Fix · GHSA-wp2f-hrg2-3r5m org.apache.uima:uimaj-as-core (Maven) Fixed in 2.10.2 Advisory →
Red Hat 1 advisory
- RHSA-2019:1545 Released 2019-06-18 · Red Hat rating ImportantRed Hat Fuse 7.3.1 security update
- Red Hat Fuse 7.3.1
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Satellite 6 | Affected | No fix planned: Will not fix |
| Red Hat Fuse 7.3.1 | Fixed | RHSA-2019:1545 |
Timeline
- 2026-10-02 Threatist record created from CVE-2017-15691
- 2026-10-03 Alias added: GHSA-wp2f-hrg2-3r5m
References
Advisory 3
Sources
- CVE-2017-15691 · CVE Program
- CVE-2017-15691 · NVD
- FIRST EPSS
- GHSA-wp2f-hrg2-3r5m · GitHub Advisory Database · CC BY 4.0
- CVE-2017-15691 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences