CVE-2023-28935
Last modified
CVE-2023-28935 is a high-severity vulnerability rated 8.8/10 on the CVSS scale. ** UNSUPPORTED WHEN ASSIGNED ** Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache Software Foundation Apache UIMA DUCC. When using the "Distributed UIMA Cluster Computing" (DUCC) module of Apache UIMA, an authenticated user that has the permissions to modify core entities can cause command execution as the system user that runs the web process. As the "Distributed UIMA Cluster Computing" module for UIMA is retired, we do not plan to release a fix for this issue. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. . EPSS estimates a 2.96% chance of exploitation in the next 30 days.
Description
** UNSUPPORTED WHEN ASSIGNED ** Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache Software Foundation Apache UIMA DUCC. When using the "Distributed UIMA Cluster Computing" (DUCC) module of Apache UIMA, an authenticated user that has the permissions to modify core entities can cause command execution as the system user that runs the web process. As the "Distributed UIMA Cluster Computing" module for UIMA is retired, we do not plan to release a fix for this issue. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Apache | Unstructured Information Management Architecture | All versions |
References
- https://lists.apache.org/thread/r19z14b9rrfxv72r93q5trq5tyffo75gMailing List, Vendor Advisory
- https://lists.apache.org/thread/r19z14b9rrfxv72r93q5trq5tyffo75gMailing List, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2023-28935?
How severe is CVE-2023-28935?
How do I fix CVE-2023-28935?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2023
- CVE-2023-2893The WP EasyCart plugin for WordPress is vulnerable to Cross-…4.3
- CVE-2023-28930Cross-Site Request Forgery (CSRF) vulnerability in Robin Phi…8.8
- CVE-2023-28931Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerabili…4.8
- CVE-2023-28932Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerabili…4.8
- CVE-2023-28933Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerabili…4.8
- CVE-2023-28934Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerabili…4.8
- CVE-2023-28936Attacker can access arbitrary recording/room Vendor: The Ap…5.3
- CVE-2023-28937DataSpider Servista version 4.4 and earlier uses a hard-code…8.8
- CVE-2023-28938Uncontrolled resource consumption in some Intel(R) SSD Tools…4.4
- CVE-2023-2894The WP EasyCart plugin for WordPress is vulnerable to Cross-…4.3
- CVE-2023-28949IBM Engineering Requirements Management DOORS 9.7.2.7 is vul…6.5
- CVE-2023-2895The WP EasyCart plugin for WordPress is vulnerable to Cross-…4.3
Are you affected by CVE-2023-28935?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST