-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.apache.uima:uimafit-core | maven | < 2.4.0 | 2.4.0 |
| org.apache.uima:uimaj-core | maven | < 2.10.2 | 2.10.2 |
| org.apache.uima:uimaj-core | maven | >= 3.0.0-alpha, <= 3.0.0-alpha02 | 3.0.0-beta |
| org.apache.uima:uimaj-as-core | maven | < 2.10.2 | 2.10.2 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from XML parsers in UIMA components not properly restricting external entity expansion. While no direct patch diffs are provided, the CVE description and security reports indicate the issue exists in multiple XML processing points across UIMA's configuration handling. Standard XXE mitigation in Java XML parsers involves:
Key XML parsing entry points would be in configuration handlers for analysis engines, type systems, and component descriptors. The identified functions represent core XML processing locations that would need security configuration changes (as evidenced by the patched versions' release notes). Confidence is medium due to reliance on vulnerability patterns rather than direct patch analysis, but aligns with: