{"action":"Upgrade edu.stanford.nlp:stanford-corenlp to 4.3.1 or later.","affected":[{"fixed":"4.3.1","introduced":"0"}],"component":"edu.stanford.nlp:stanford-corenlp","cve_ids":["CVE-2021-3869"],"ecosystem":"Maven","epss":0.0136,"exploited":false,"fixed_versions":["4.3.1"],"ghsa_id":"GHSA-8gf7-w3cp-gfh3","id":"tcs_01M5N8MMTXDJT9SVG54N3KBRR1","modified_at":"2023-11-08T04:06:29.055392Z","published_at":"2022-05-24T19:18:01Z","references":["https://osv.dev/vulnerability/GHSA-8gf7-w3cp-gfh3","https://nvd.nist.gov/vuln/detail/CVE-2021-3869","https://github.com/stanfordnlp/corenlp/commit/5d83f1e8482ca304db8be726cad89554c88f136a","https://github.com/stanfordnlp/CoreNLP","https://huntr.dev/bounties/2f8baf6c-14b3-420d-8ede-9805797cd324"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-8gf7-w3cp-gfh3","url":"https://osv.dev/vulnerability/GHSA-8gf7-w3cp-gfh3"}],"summary":"Improper Restriction of XML External Entity Reference in Stanford CoreNLP"}