CVE-2023-28935 Apache UIMA DUCC: DUCC (EOL) allows RCE
Authenticated users with entity modification permissions can execute arbitrary commands as the system user in the retired Apache UIMA DUCC module.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-28935?
CVE-2023-28935 is a high-severity command injection vulnerability in Apache UIMA DUCC, published on 30 Mar 2023. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
** UNSUPPORTED WHEN ASSIGNED ** Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache Software Foundation Apache UIMA DUCC.
When using the "Distributed UIMA Cluster Computing" (DUCC) module of Apache UIMA, an authenticated user that has the permissions to modify core entities can cause command execution as the system user that runs the web process.
As the "Distributed UIMA Cluster Computing" module for UIMA is retired, we do not plan to release a fix for this issue. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
Weakness: CWE-77
Which versions are affected by CVE-2023-28935?
2 open source packages ship an affected version, including org.apache.uima:uima-ducc-parent. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.apache.uima:uima-ducc-parent Maven | All versions to 3.0.0 | None |
org.apache.uima:uima-ducc-parent Maven | All versions to 3.0.0 | None |
Products include Apache Unstructured Information Management Architecture.
How do I fix CVE-2023-28935?
No fix has been published for CVE-2023-28935 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2023-28935 being exploited?
There is no known exploitation of CVE-2023-28935 in the wild and no public exploit code.
Sources
Also known as GHSA-34m5-796p-mjcp.