CVE-2023-28935: 
Java vulnerability analysis and mitigation

A command injection vulnerability (CVE-2023-28935) was identified in Apache Software Foundation's Apache UIMA DUCC (Distributed UIMA Cluster Computing) module. The vulnerability was disclosed on March 30, 2023. This security flaw affects the DUCC module of Apache UIMA, which is now in an end-of-life (EOL) state (Apache Advisory).

The vulnerability is classified as an Improper Neutralization of Special Elements used in a Command (Command Injection) vulnerability, identified as CWE-77. It received a CVSS v3.1 base score of 8.8 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating a serious security risk (NVD).

When exploited, this vulnerability allows an authenticated user with permissions to modify core entities to execute commands as the system user that runs the web process. This could lead to unauthorized command execution and potential system compromise (NVD).

No official fix will be released as the Distributed UIMA Cluster Computing module for UIMA is retired and no longer supported by the maintainer. Users are advised to migrate away from using this EOL component (Apache Advisory).