CVE-2022-0198: 
Java vulnerability analysis and mitigation

CoreNLP was found to be vulnerable to Improper Restriction of XML External Entity Reference (XXE) as identified in CVE-2022-0198. The vulnerability affects CoreNLP versions up to and including 4.3.2. This security issue was discovered and reported in January 2022 (NVD).

The vulnerability received a CVSS v3.1 base score of 7.1 (HIGH) with vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N. The issue was classified as CWE-611: Improper Restriction of XML External Entity Reference. The vulnerability stems from improper configuration of the SAX parser in the XML processing components (NVD).

The vulnerability could allow an attacker to potentially execute XXE attacks, which might lead to unauthorized disclosure of sensitive information and system file access. The CVSS scoring indicates high potential impact on both confidentiality and integrity of the affected system (NVD).

A patch was released that addresses the vulnerability by enabling secure processing feature for the SAX parser. The fix involves adding XMLConstants.FEATURESECUREPROCESSING flag to the SAXParserFactory configuration (CoreNLP Patch).