CVE-2021-44550: 
Java vulnerability analysis and mitigation

An Incorrect Access Control vulnerability (CVE-2021-44550) was identified in Stanford CoreNLP version 4.3.2. The vulnerability specifically affects the classifier parameter handling in NERServlet.java (lines 158 and 159). This security issue was discovered and reported in November 2021 (GitHub Issue).

The vulnerability exists in the NERServlet.java file where unvalidated data from the 'classifier' parameter is directly included in HTTP response headers. The issue occurs specifically on lines 158 and 159 of NERServlet.java. According to the National Vulnerability Database, this vulnerability has been assigned a CVSS v3.1 Base Score of 9.8 (CRITICAL) with the vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (NVD).

The vulnerability can enable several types of attacks including cache-poisoning, cross-site scripting, cross-user defacement, page hijacking, cookie manipulation, and open redirect. This occurs because the application includes unvalidated data in HTTP response headers without proper sanitization (GitHub Issue).

The vulnerability has been marked as 'fixed' in released CoreNLP versions after the issue was reported (GitHub Issue). Users should upgrade to a patched version of CoreNLP to mitigate this vulnerability.