GitHub Advisoryadvisory · Maven
GHSA-q56h-jjj6-52mf Improper Restriction of XML External Entity Reference in Apache POI
MEDIUM
Official page ↗
- Aliases
- CVE-2014-3529
- Ecosystem
- Maven
- Packages
- org.apache.poi:poi
- Severity
- Moderate
- Weaknesses
- CWE-611
- Reviewed
- 2022-07-07
Affected packages
• Maven org.apache.poi:poi: < 3.10.1 → fixed in 3.10.1
Description
The OPC SAX setup in Apache POI before 3.10.1 allows remote attackers to read arbitrary files via an OpenXML file containing an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
Related
Alias · CVE (1)
- CVE-2014-3529 The OPC SAX setup in Apache POI before 3.10.1 allows remote attackers to read arbitrary files via an OpenXML file containing an XML… vulnerability
Weakness · CWE (1)
- CWE-611 Improper Restriction of XML External Entity Reference weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2014-3529 advisory
- https://github.com/apache/poi/commit/103b45073c7b504236588b3acc146530205af53c web
- https://github.com/apache/poi/commit/236c3c52a9b90688b2e57ec503559409e29f33ed web
- https://github.com/apache/poi/commit/6050a68d5adfb4ffef1edb778add09bcee32d1c3 web
- https://github.com/apache/poi/commit/d72bd78c19dfb7b57395a66ae8d9269d59a87bd2 web
- https://github.com/apache/poi/commit/eabb6a924be24abb879372d0bc967e0d316b2cf8 web
- https://exchange.xforce.ibmcloud.com/vulnerabilities/95770 web
- https://github.com/apache/poi package
- https://lucene.apache.org/solr/solrnews.html#18-august-2014-recommendation-to-update-apache-poi-in-apache-solr-480-481-and-490-installations web
- http://poi.apache.org/changes.html web
- http://rhn.redhat.com/errata/RHSA-2014-1370.html web
- http://rhn.redhat.com/errata/RHSA-2014-1398.html web
- http://rhn.redhat.com/errata/RHSA-2014-1399.html web
- http://rhn.redhat.com/errata/RHSA-2014-1400.html web
- http://www-01.ibm.com/support/docview.wss?uid=swg21996759 web
- http://www.apache.org/dist/poi/release/RELEASE-NOTES.txt web