CVE-2021-3878 Improper Restriction of XML External Entity Reference in stanfordnlp/corenlp

Critical 9.8 Published 15 Oct 2021 Updated 3 Aug 2024

Attackers can exploit XML External Entity vulnerabilities in Stanford CoreNLP to read sensitive files or cause denial of service.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2021-3878?

CVE-2021-3878 is a critical vulnerability in stanfordnlp/corenlp, published on 15 Oct 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

corenlp is vulnerable to Improper Restriction of XML External Entity Reference

Weakness: CWE-611

Which versions are affected by CVE-2021-3878?

2 open source packages ship an affected version, including edu.stanford.nlp:stanford-corenlp. It affects 1 product.

Package	Affected	Fixed in
`edu.stanford.nlp:stanford-corenlp` Maven	All versions	`4.3.1`
`edu.stanford.nlp:stanford-corenlp` Maven	All versions	`4.3.1`

Products include Stanford Corenlp.

How do I fix CVE-2021-3878?

Upgrade edu.stanford.nlp:stanford-corenlp to 4.3.1 or later.

Is CVE-2021-3878 being exploited?

There is no known exploitation of CVE-2021-3878 in the wild and no public exploit code.

Sources

Also known as GHSA-5h9g-8xcv-qjq9.