Medium severity6.1NVD Advisory· Published May 1, 2019· Updated Jun 17, 2026

CVE-2018-8035

Description

This vulnerability relates to the user's browser processing of DUCC webpage input data.The javascript comprising Apache UIMA DUCC (<= 2.2.2) which runs in the user's browser does not sufficiently filter user supplied inputs, which may result in unintended execution of user supplied javascript code.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
org.apache.uima:uima-ducc-webMaven	< 3.0.0	3.0.0

Affected products

Apache/uimaDUCC2 versions
cpe:2.3:a:apache:uimaducc:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:apache:uimaducc:*:*:*:*:*:*:*:*range: <=2.2.2
- (no CPE)range: Apache UIMA DUCC releases including and prior to 2.2.2
ghsa-coords
pkg:maven/org.apache.uima/uima-ducc-web
Range: < 3.0.0

Patches

Vulnerability mechanics

References

github.com/advisories/GHSA-vm59-329q-p468ghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2018-8035ghsaADVISORY
uima.apache.org/security_reportnvdVendor AdvisoryWEB
www.securityfocus.com/bid/108195nvdWEB
lists.apache.org/thread.html/2f49681259b375d53431605f1c557ef8a3ed0af01a488d2e1b330053@%3Cdev.uima.apache.org%3EghsaWEB
lists.apache.org/thread.html/2f49681259b375d53431605f1c557ef8a3ed0af01a488d2e1b330053%40%3Cdev.uima.apache.org%3Envd

News mentions

No linked articles in our index yet.

cvss	0.397
epss	0.004
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000