Improper Restriction of XML External Entity Reference in Apache POI

보통 5.5CVE-2019-12415 · GHSA-9jwc-q6j3-8g9g · Published 23/10/2019 · updated 17/06/2026

요약

CVE-2019-12415은(는) org.apache.poi:poi, poi (apache), application testing suite (oracle)에 영향을 주는 보통 (CVSS 5.5) 취약점입니다.
향후 30일 내 악용 확률(EPSS): 1.00%, 전체 취약점의 62.8%보다 높음.
조치: 4.1.1 이상으로 업데이트하세요.

Package	Affected versions	Patched versions
org.apache.poi:poi Maven	`< 4.1.1`	`4.1.1`
poi apache	`≤ 4.1.0`	No fix yet
application testing suite oracle	`= 12.5.0.3= 13.1.0.1= 13.2.0.1= 13.3.0.1`	No fix yet
banking enterprise originations oracle	`= 2.7.0= 2.8.0`	No fix yet
banking enterprise product manufacturing oracle	`= 2.7.0= 2.8.0`	No fix yet
banking payments oracle	`= 14.0.0= 14.1.0`	No fix yet
banking platform oracle	`= 2.4.0= 2.4.1= 2.5.0= 2.6.0= 2.6.1= 2.6.2= 2.7.0= 2.7.1= 2.9.0`	No fix yet
big data discovery oracle	`= 1.6`	No fix yet
communications diameter signaling router idih oracle	`= 8.0.0= 8.2.2`	No fix yet
endeca information discovery studio oracle	`= 3.2.0`	No fix yet
enterprise manager base platform oracle	`= 12.1.0.5= 13.3.0.0= 13.4.0.0`	No fix yet
enterprise repository oracle	`= 12.1.3.0.0`	No fix yet
financial services analytical applications infrastructure oracle	`≥ 8.0.6, ≤ 8.0.9`	No fix yet
financial services market risk measurement and management oracle	`= 8.0.6= 8.0.8`	No fix yet
flexcube private banking oracle	`= 12.0.0= 12.1.0`	No fix yet
hyperion infrastructure technology oracle	`= 11.1.2.4`	No fix yet
instantis enterprisetrack oracle	`= 17.1= 17.2= 17.3`	No fix yet
insurance policy administration j2ee oracle	`= 11.0.2= 11.1.0= 11.2.0`	No fix yet
insurance rules palette oracle	`= 10.2.0= 10.2.4= 11.0.2= 11.1.0= 11.2.0`	No fix yet
jdeveloper oracle	`= 12.2.1.4.0`	No fix yet
peoplesoft enterprise peopletools oracle	`= 8.57= 8.58= 8.59`	No fix yet
primavera gateway oracle	`= 17.12.6= 18.8.8.1`	No fix yet
primavera unifier oracle	`= 16.1= 16.2= 18.8= 19.12≥ 17.7, ≤ 17.12`	No fix yet
retail clearance optimization engine oracle	`= 14.0`	No fix yet
retail order broker oracle	`= 15.0= 16.0`	No fix yet
retail predictive application server oracle	`= 15.0.3= 16.0.3`	No fix yet
webcenter portal oracle	`= 12.2.1.3.0= 12.2.1.4.0`	No fix yet
webcenter sites oracle	`= 12.2.1.3.0= 12.2.1.4.0`	No fix yet

Description

In Apache POI up to 4.1.0, when using the tool XSSFExportToXml to convert user-provided Microsoft Excel documents, a specially crafted document can allow an attacker to read files from the local filesystem or from internal network resources via XML External Entity (XXE) Processing.

NVD description

References

org.apache.poi:poi의 다른 취약점

모두 보기 →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free