GitHub Advisoryadvisory · Maven

GHSA-78vv-qj73-h9m5 Improper Restriction of Recursive Entity References in DTDs in Apache POI

MEDIUM Published 2022-05-13 Modified 2022-07-01 Official page ↗
Aliases
CVE-2017-5644
Ecosystem
Maven
Packages
org.apache.poi:poi
Severity
Moderate
CVSS vector
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Weaknesses
CWE-776
Reviewed
2022-07-01

Affected packages

• Maven org.apache.poi:poi: < 3.15 → fixed in 3.15

Description

Apache POI in versions prior to release 3.15 allows remote attackers to cause a denial of service (CPU consumption) via a specially crafted OOXML file, aka an XML Entity Expansion (XEE) attack.

Related

Alias · CVE (1)

  • CVE-2017-5644 Apache POI in versions prior to release 3.15 allows remote attackers to cause a denial of service (CPU consumption) via a specially crafted… vulnerability

Weakness · CWE (1)

  • CWE-776 Improper Restriction of Recursive Entity References in DTDs weakness

References