CVSS 3.1
8.8 highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HCVE-2023-28935
High (8.8) in apache unstructured information management architecture. No vendor fix: the product was unsupported when the CVE was assigned. EPSS 2.9% chance of exploitation in the next 30 days.
Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache Software Foundation Apache UIMA DUCC.
When using the "Distributed UIMA Cluster Computing" (DUCC) module of Apache UIMA, an authenticated user that has the permissions to modify core entities can cause command execution as the system user that runs the web process.
As the "Distributed UIMA Cluster Computing" module for UIMA is retired, we do not plan to release a fix for this issue.
NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
Severity
- EPSS
- 2.9% chance of exploitation in the next 30 days; higher than 86% of CVEs (scores of 2026-10-31)
- CWE
- CWE-77
- Published
- Modified
- Record from
- the NVD, synced
Affected
- apache:unstructured_information_management_architecture
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-34m5-796p-mjcp | Maven | org.apache.uima:uima-ducc-parent | <=3.0.0 | no fix published |