Medium severity6.5NVD Advisory· Published Apr 26, 2018· Updated Jun 17, 2026
CVE-2017-15691
CVE-2017-15691
Description
In Apache uimaj prior to 2.10.2, Apache uimaj 3.0.0-xxx prior to 3.0.0-beta, Apache uima-as prior to 2.10.2, Apache uimaFIT prior to 2.4.0, Apache uimaDUCC prior to 2.2.2, this vulnerability relates to an XML external entity expansion (XXE) capability of various XML parsers. UIMA as part of its configuration and operation may read XML from various sources, which could be tainted in ways to cause inadvertent disclosure of local files or other internal content.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
org.apache.uima:uimafit-coreMaven | < 2.4.0 | 2.4.0 |
org.apache.uima:uimaj-coreMaven | < 2.10.2 | 2.10.2 |
org.apache.uima:uimaj-coreMaven | >= 3.0.0-alpha, < 3.0.0-beta | 3.0.0-beta |
org.apache.uima:uimaj-as-coreMaven | < 2.10.2 | 2.10.2 |
Affected products
4- ghsa-coords3 versionspkg:maven/org.apache.uima/uimafit-corepkg:maven/org.apache.uima/uimaj-as-corepkg:maven/org.apache.uima/uimaj-core
< 2.4.0+ 2 more
- (no CPE)range: < 2.4.0
- (no CPE)range: < 2.10.2
- (no CPE)range: < 2.10.2
Patches
Vulnerability mechanics
References
6- github.com/advisories/GHSA-wp2f-hrg2-3r5mghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2017-15691ghsaADVISORY
- uima.apache.org/security_reportnvdVendor AdvisoryWEB
- access.redhat.com/errata/RHSA-2019:1545nvdWEB
- lists.apache.org/thread.html/00407c65738e625a8cc9d732923a4ab2d8299603cc7c7e5cc2da9c79@%3Ccommits.uima.apache.org%3EghsaWEB
- lists.apache.org/thread.html/00407c65738e625a8cc9d732923a4ab2d8299603cc7c7e5cc2da9c79%40%3Ccommits.uima.apache.org%3Envd
News mentions
0No linked articles in our index yet.