Improper Restriction of XML External Entity Reference in Apache POI

MEDIUM 5.5CVE-2019-12415 · GHSA-9jwc-q6j3-8g9g · Published 23/10/2019 · updated 17/06/2026

In short

CVE-2019-12415 is a MEDIUM (CVSS 5.5) vulnerability affecting org.apache.poi:poi, poi (apache), application testing suite (oracle).
Chance of exploitation in the next 30 days (EPSS): 1.00%, higher than 62.8% of all vulnerabilities.
Fix: update to 4.1.1 or later.

Package	Affected versions	Patched versions
org.apache.poi:poi Maven	`< 4.1.1`	`4.1.1`
poi apache	`≤ 4.1.0`	No fix yet
application testing suite oracle	`= 12.5.0.3= 13.1.0.1= 13.2.0.1= 13.3.0.1`	No fix yet
banking enterprise originations oracle	`= 2.7.0= 2.8.0`	No fix yet
banking enterprise product manufacturing oracle	`= 2.7.0= 2.8.0`	No fix yet
banking payments oracle	`= 14.0.0= 14.1.0`	No fix yet
banking platform oracle	`= 2.4.0= 2.4.1= 2.5.0= 2.6.0= 2.6.1= 2.6.2= 2.7.0= 2.7.1= 2.9.0`	No fix yet
big data discovery oracle	`= 1.6`	No fix yet
communications diameter signaling router idih oracle	`= 8.0.0= 8.2.2`	No fix yet
endeca information discovery studio oracle	`= 3.2.0`	No fix yet
enterprise manager base platform oracle	`= 12.1.0.5= 13.3.0.0= 13.4.0.0`	No fix yet
enterprise repository oracle	`= 12.1.3.0.0`	No fix yet
financial services analytical applications infrastructure oracle	`≥ 8.0.6, ≤ 8.0.9`	No fix yet
financial services market risk measurement and management oracle	`= 8.0.6= 8.0.8`	No fix yet
flexcube private banking oracle	`= 12.0.0= 12.1.0`	No fix yet
hyperion infrastructure technology oracle	`= 11.1.2.4`	No fix yet
instantis enterprisetrack oracle	`= 17.1= 17.2= 17.3`	No fix yet
insurance policy administration j2ee oracle	`= 11.0.2= 11.1.0= 11.2.0`	No fix yet
insurance rules palette oracle	`= 10.2.0= 10.2.4= 11.0.2= 11.1.0= 11.2.0`	No fix yet
jdeveloper oracle	`= 12.2.1.4.0`	No fix yet
peoplesoft enterprise peopletools oracle	`= 8.57= 8.58= 8.59`	No fix yet
primavera gateway oracle	`= 17.12.6= 18.8.8.1`	No fix yet
primavera unifier oracle	`= 16.1= 16.2= 18.8= 19.12≥ 17.7, ≤ 17.12`	No fix yet
retail clearance optimization engine oracle	`= 14.0`	No fix yet
retail order broker oracle	`= 15.0= 16.0`	No fix yet
retail predictive application server oracle	`= 15.0.3= 16.0.3`	No fix yet
webcenter portal oracle	`= 12.2.1.3.0= 12.2.1.4.0`	No fix yet
webcenter sites oracle	`= 12.2.1.3.0= 12.2.1.4.0`	No fix yet

Description

In Apache POI up to 4.1.0, when using the tool XSSFExportToXml to convert user-provided Microsoft Excel documents, a specially crafted document can allow an attacker to read files from the local filesystem or from internal network resources via XML External Entity (XXE) Processing.

NVD description

References

More vulnerabilities in org.apache.poi:poi

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free