GitHub Advisoryadvisory · Maven

GHSA-9jwc-q6j3-8g9g Improper Restriction of XML External Entity Reference in Apache POI

MEDIUM Published 2022-05-24 Modified 2022-11-17 Official page ↗
Aliases
CVE-2019-12415
Ecosystem
Maven
Packages
org.apache.poi:poi
Severity
Moderate
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-611
Reviewed
2022-06-28

Affected packages

• Maven org.apache.poi:poi: < 4.1.1 → fixed in 4.1.1

Description

In Apache POI up to 4.1.0, when using the tool XSSFExportToXml to convert user-provided Microsoft Excel documents, a specially crafted document can allow an attacker to read files from the local filesystem or from internal network resources via XML External Entity (XXE) Processing.

Related

Alias · CVE (1)

  • CVE-2019-12415 In Apache POI up to 4.1.0, when using the tool XSSFExportToXml to convert user-provided Microsoft Excel documents, a specially crafted… vulnerability

Weakness · CWE (1)

  • CWE-611 Improper Restriction of XML External Entity Reference weakness

References