GitHub Advisoryadvisory · Maven

GHSA-5wfp-8643-c58x Improper Input Validation in Apache POI

MEDIUM Published 2022-05-17 Modified 2024-04-16 Official page ↗
Aliases
CVE-2014-3574
Ecosystem
Maven
Packages
org.apache.poi:poi
Severity
Moderate
Weaknesses
CWE-20
Reviewed
2022-07-07

Affected packages

• Maven org.apache.poi:poi: < 3.10.1 → fixed in 3.10.1 • Maven org.apache.poi:poi: >= 3.11-beta1, < 3.11-beta2 → fixed in 3.11-beta2

Description

Apache POI before 3.10.1 and 3.11.x before 3.11-beta2 allows remote attackers to cause a denial of service (CPU consumption and crash) via a crafted OOXML file, aka an XML Entity Expansion (XEE) attack.

Related

Alias · CVE (1)

  • CVE-2014-3574 Apache POI before 3.10.1 and 3.11.x before 3.11-beta2 allows remote attackers to cause a denial of service (CPU consumption and crash) via… vulnerability

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References