Improper Restriction of XML External Entity Reference in Apache POI

MEDIO 5.5CVE-2019-12415 · GHSA-9jwc-q6j3-8g9g · Published 23/10/2019 · updated 17/06/2026

En resumen

CVE-2019-12415 es una vulnerabilidad MEDIO (CVSS 5.5) que afecta a org.apache.poi:poi, poi (apache), application testing suite (oracle).
Probabilidad de explotación en los próximos 30 días (EPSS): 1.00%, mayor que el 62.8% de las vulnerabilidades.
Solución: actualizar a 4.1.1 o posterior.

Package	Affected versions	Patched versions
org.apache.poi:poi Maven	`< 4.1.1`	`4.1.1`
poi apache	`≤ 4.1.0`	No fix yet
application testing suite oracle	`= 12.5.0.3= 13.1.0.1= 13.2.0.1= 13.3.0.1`	No fix yet
banking enterprise originations oracle	`= 2.7.0= 2.8.0`	No fix yet
banking enterprise product manufacturing oracle	`= 2.7.0= 2.8.0`	No fix yet
banking payments oracle	`= 14.0.0= 14.1.0`	No fix yet
banking platform oracle	`= 2.4.0= 2.4.1= 2.5.0= 2.6.0= 2.6.1= 2.6.2= 2.7.0= 2.7.1= 2.9.0`	No fix yet
big data discovery oracle	`= 1.6`	No fix yet
communications diameter signaling router idih oracle	`= 8.0.0= 8.2.2`	No fix yet
endeca information discovery studio oracle	`= 3.2.0`	No fix yet
enterprise manager base platform oracle	`= 12.1.0.5= 13.3.0.0= 13.4.0.0`	No fix yet
enterprise repository oracle	`= 12.1.3.0.0`	No fix yet
financial services analytical applications infrastructure oracle	`≥ 8.0.6, ≤ 8.0.9`	No fix yet
financial services market risk measurement and management oracle	`= 8.0.6= 8.0.8`	No fix yet
flexcube private banking oracle	`= 12.0.0= 12.1.0`	No fix yet
hyperion infrastructure technology oracle	`= 11.1.2.4`	No fix yet
instantis enterprisetrack oracle	`= 17.1= 17.2= 17.3`	No fix yet
insurance policy administration j2ee oracle	`= 11.0.2= 11.1.0= 11.2.0`	No fix yet
insurance rules palette oracle	`= 10.2.0= 10.2.4= 11.0.2= 11.1.0= 11.2.0`	No fix yet
jdeveloper oracle	`= 12.2.1.4.0`	No fix yet
peoplesoft enterprise peopletools oracle	`= 8.57= 8.58= 8.59`	No fix yet
primavera gateway oracle	`= 17.12.6= 18.8.8.1`	No fix yet
primavera unifier oracle	`= 16.1= 16.2= 18.8= 19.12≥ 17.7, ≤ 17.12`	No fix yet
retail clearance optimization engine oracle	`= 14.0`	No fix yet
retail order broker oracle	`= 15.0= 16.0`	No fix yet
retail predictive application server oracle	`= 15.0.3= 16.0.3`	No fix yet
webcenter portal oracle	`= 12.2.1.3.0= 12.2.1.4.0`	No fix yet
webcenter sites oracle	`= 12.2.1.3.0= 12.2.1.4.0`	No fix yet

Description

In Apache POI up to 4.1.0, when using the tool XSSFExportToXml to convert user-provided Microsoft Excel documents, a specially crafted document can allow an attacker to read files from the local filesystem or from internal network resources via XML External Entity (XXE) Processing.

NVD description

References

Más vulnerabilidades de org.apache.poi:poi

Ver todo →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free