Stanford CoreNLP provides a set of natural language analysis tools which can take raw English language text input and give the base forms of words, their parts of speech, whether they are names of companies, people, etc., normalize dates, times, and numeric quantities, mark up the structure of sentences in terms of phrases and word dependencies, and indicate which noun phrases refer to the same entities. It provides the foundational building blocks for higher level text understanding applications.
Stanford CoreNLP provides a set of natural language analysis tools which can take raw English language text input and give the base forms of words, their parts of speech, whether they are names of companies, people, etc., normalize dates, times, and numeric quantities, mark up the structure of sentences in terms of phrases and word dependencies, and indicate which noun phrases refer to the same entities. It provides the foundational building blocks for higher level text understanding applications.
CVE-2021-44550 - High Severity Vulnerability
stanford-corenlp-3.9.2.jar
Stanford CoreNLP provides a set of natural language analysis tools which can take raw English language text input and give the base forms of words, their parts of speech, whether they are names of companies, people, etc., normalize dates, times, and numeric quantities, mark up the structure of sentences in terms of phrases and word dependencies, and indicate which noun phrases refer to the same entities. It provides the foundational building blocks for higher level text understanding applications.
Library home page: https://nlp.stanford.edu/software/corenlp.html
Path to dependency file: /tools/reminder-bot/pom.xml
Path to vulnerable library: /repository/edu/stanford/nlp/stanford-corenlp/3.9.2/stanford-corenlp-3.9.2-models.jar
Dependency Hierarchy: - :x: **stanford-corenlp-3.9.2.jar** (Vulnerable Library)
stanford-corenlp-3.9.2.jar
Stanford CoreNLP provides a set of natural language analysis tools which can take raw English language text input and give the base forms of words, their parts of speech, whether they are names of companies, people, etc., normalize dates, times, and numeric quantities, mark up the structure of sentences in terms of phrases and word dependencies, and indicate which noun phrases refer to the same entities. It provides the foundational building blocks for higher level text understanding applications.
Library home page: https://nlp.stanford.edu/software/corenlp.html
Path to dependency file: /tools/reminder-bot/pom.xml
Path to vulnerable library: /repository/edu/stanford/nlp/stanford-corenlp/3.9.2/stanford-corenlp-3.9.2.jar
Dependency Hierarchy: - :x: **stanford-corenlp-3.9.2.jar** (Vulnerable Library)
Found in HEAD commit: 3da9e0f849079934eb92135cec1f523e22bdc1ad
Found in base branch: spring-bot-master
An Incorrect Access Control vulnerability exists in CoreNLP 4.3.2 via the classifier in NERServlet.java (lines 158 and 159).
Publish Date: 2022-02-24
URL: CVE-2021-44550
Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High
For more information on CVSS3 Scores, click here.Type: Upgrade version
Origin: https://github.com/stanfordnlp/CoreNLP/issues/1222
Release Date: 2022-02-24
Fix Resolution: edu.stanford.nlp:stanford-corenlp:4.4.0