CVE-2018-8035 Cross-site Scripting in Apache UIMA
MediumCVSS 6.1
EPSS 4.9%
- Published
- Updated
- Exploit status
- No public exploit known
Description
This vulnerability relates to the user's browser processing of DUCC webpage input data.The javascript comprising Apache UIMA DUCC (<= 2.2.2) which runs in the user's browser does not sufficiently filter user supplied inputs, which may result in unintended execution of user supplied javascript code.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| org.apache.uima/uima-ducc-web(Maven) | <= 2.2.2 | No fix listed |
| org.apache.uima/uima-ducc-web(Maven) | < 3.0.0 | 3.0.0 |
| org.apache.uima/uima-ducc-web(Maven) | = 1.0.0 | No fix listed |
| org.apache.uima/uima-ducc-web(Maven) | = 1.1.0 | No fix listed |
| org.apache.uima/uima-ducc-web(Maven) | = 2.0.0 | No fix listed |
| org.apache.uima/uima-ducc-web(Maven) | = 2.0.1 | No fix listed |
| org.apache.uima/uima-ducc-web(Maven) | = 2.1.0 | No fix listed |
| org.apache.uima/uima-ducc-web(Maven) | = 2.2.0 | No fix listed |
| org.apache.uima/uima-ducc-web(Maven) | = 2.2.1 | No fix listed |
| org.apache.uima/uima-ducc-web(Maven) | = 2.2.2 | No fix listed |
| apache uimaducc | <= 2.2.2 | No fix listed |
| ubuntu/uimaj(Ubuntu:24.04) | All versions | No fix listed |
| ubuntu/uimaj(Ubuntu:26.04) | All versions | No fix listed |
| ubuntu/uimaj(Ubuntu:26.10) | All versions | No fix listed |
| Apache UIMA DUCC | = Apache UIMA DUCC releases including and prior to 2.2.2 | No fix listed |
| ubuntu/uimaj(Ubuntu:22.04) | All versions | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- uima.apache.org vendor-advisory
- lists.apache.org
- 108195 vdb-entry
- github.com
- Ubuntu CVE tracker vendor-advisory
- www.cve.org
- [uima-dev] 20190606 Re: upcoming board report mailing-list