CVE-2022-0198 Improper Restriction of XML External Entity Reference in stanfordnlp/corenlp

Medium 6.1 Published 13 Jan 2022 Updated 2 Aug 2024

Attackers can exploit XML External Entity vulnerabilities in Stanford CoreNLP to read sensitive files or cause denial of service.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2022-0198?

CVE-2022-0198 is a medium-severity vulnerability in stanfordnlp/corenlp, published on 13 Jan 2022. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

corenlp is vulnerable to Improper Restriction of XML External Entity Reference

Weakness: CWE-611

Which versions are affected by CVE-2022-0198?

2 open source packages ship an affected version, including edu.stanford.nlp:stanford-corenlp. It affects 1 product.

Package	Affected	Fixed in
`edu.stanford.nlp:stanford-corenlp` Maven	All versions to `4.3.2`	None
`edu.stanford.nlp:stanford-corenlp` Maven	All versions to `4.3.2`	None

Products include Stanford Corenlp.

How do I fix CVE-2022-0198?

No fix has been published for CVE-2022-0198 yet. Limit exposure of the affected software until one is available.

Is CVE-2022-0198 being exploited?

There is no known exploitation of CVE-2022-0198 in the wild and no public exploit code.

Sources

Also known as GHSA-mh83-jcw5-rjh8.