CVEvulnerability

CVE-2019-12415

5.5 MEDIUM Published 2019-10-23 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2019-10-23
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
5.5 MEDIUM — CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0 ([email protected])
2.1 LOW — AV:L/AC:L/Au:N/C:P/I:N/A:N
Weaknesses
CWE-611

Description

In Apache POI up to 4.1.0, when using the tool XSSFExportToXml to convert user-provided Microsoft Excel documents, a specially crafted document can allow an attacker to read files from the local filesystem or from internal network resources via XML External Entity (XXE) Processing.

Affected configurations

• apache poi (<= 4.1.0) • oracle application testing suite 12.5.0.3 • oracle application testing suite 13.1.0.1 • oracle application testing suite 13.2.0.1 • oracle application testing suite 13.3.0.1 • oracle banking enterprise originations 2.7.0 • oracle banking enterprise originations 2.8.0 • oracle banking enterprise product manufacturing 2.7.0 • oracle banking enterprise product manufacturing 2.8.0 • oracle banking payments 14.0.0 • oracle banking payments 14.1.0 • oracle banking platform 2.4.0 • oracle banking platform 2.4.1 • oracle banking platform 2.5.0 • oracle banking platform 2.6.0 • oracle banking platform 2.6.1 • oracle banking platform 2.6.2 • oracle banking platform 2.7.0 • oracle banking platform 2.7.1 • oracle banking platform 2.9.0 • oracle big data discovery 1.6 • oracle communications diameter signaling router idih\ • oracle endeca information discovery studio 3.2.0 • oracle enterprise manager base platform 12.1.0.5 • oracle enterprise manager base platform 13.3.0.0 • oracle enterprise manager base platform 13.4.0.0 • oracle enterprise repository 12.1.3.0.0 • oracle financial services analytical applications infrastructure (>= 8.0.6 <= 8.0.9) • oracle financial services market risk measurement and management 8.0.6 • oracle financial services market risk measurement and management 8.0.8 • oracle flexcube private banking 12.0.0 • oracle flexcube private banking 12.1.0 • oracle hyperion infrastructure technology 11.1.2.4 • oracle instantis enterprisetrack 17.1 • oracle instantis enterprisetrack 17.2 • oracle instantis enterprisetrack 17.3 • oracle insurance policy administration j2ee 11.0.2 • oracle insurance policy administration j2ee 11.1.0 • oracle insurance policy administration j2ee 11.2.0 • oracle insurance rules palette 10.2.0 • oracle insurance rules palette 10.2.4 • oracle insurance rules palette 11.0.2 • oracle insurance rules palette 11.1.0 • oracle insurance rules palette 11.2.0 • oracle jdeveloper 12.2.1.4.0 • oracle peoplesoft enterprise peopletools 8.57 • oracle peoplesoft enterprise peopletools 8.58 • oracle peoplesoft enterprise peopletools 8.59 • oracle primavera gateway 17.12.6 • oracle primavera gateway 18.8.8.1 • oracle primavera unifier (>= 17.7 <= 17.12) • oracle primavera unifier 16.1 • oracle primavera unifier 16.2 • oracle primavera unifier 18.8 • oracle primavera unifier 19.12 • oracle retail clearance optimization engine 14.0 • oracle retail order broker 15.0 • oracle retail order broker 16.0 • oracle retail predictive application server 15.0.3 • oracle retail predictive application server 16.0.3 … and 4 more

Related

Weakness · CWE (1)

  • CWE-611 Improper Restriction of XML External Entity Reference weakness

References