GitHub Advisoryadvisory · Maven

GHSA-xvm2-9xvc-hx7f Improper Restriction of XML External Entity Reference in com.monitorjbl:xlsx-streamer

CRITICAL Published 2022-03-02 Modified 2022-03-10 Official page ↗
Aliases
CVE-2022-23640
Ecosystem
Maven
Packages
com.monitorjbl:xlsx-streamer
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-611, CWE-776
Reviewed
2022-03-02

Affected packages

• Maven com.monitorjbl:xlsx-streamer: < 2.1.0 → fixed in 2.1.0

Description

Impact Prior to xlsx-streamer 2.1.0, the XML parser that was used did not apply all the necessary settings to prevent XML Entity Expansion issues. Patches Upgrade to version 2.1.0. Workarounds No known workaround. References https://github.com/monitorjbl/excel-streaming-reader/commit/0749c7b9709db078ccdeada16d46a34bc2910c73 For more information If you have any questions or comments about this advisory: • Open an issue in monitorjbl/excel-streaming-reader

Related

Alias · CVE (1)

  • CVE-2022-23640 Excel-Streaming-Reader is an easy-to-use implementation of a streaming Excel reader using Apache POI. vulnerability

Weakness · CWE (2)

  • CWE-611 Improper Restriction of XML External Entity Reference weakness
  • CWE-776 Improper Restriction of Recursive Entity References in DTDs weakness

References