Improper Restriction of XML External Entity Reference in com.monitorjbl:xlsx-streamer

심각 9.8CVE-2022-23640 · GHSA-xvm2-9xvc-hx7f · Published 02/03/2022 · updated 17/06/2026

요약

CVE-2022-23640은(는) com.monitorjbl:xlsx-streamer, excel streaming reader (excel streaming reader project)에 영향을 주는 심각 (CVSS 9.8) 취약점입니다.
향후 30일 내 악용 확률(EPSS): 1.3%, 전체 취약점의 70.1%보다 높음.
조치: 2.1.0 이상으로 업데이트하세요.

Package	Affected versions	Patched versions
com.monitorjbl:xlsx-streamer Maven	`< 2.1.0`	`2.1.0`
excel streaming reader excel_streaming_reader_project	`< 2.1.0`	`2.1.0`

Description

Impact

Prior to xlsx-streamer 2.1.0, the XML parser that was used did not apply all the necessary settings to prevent XML Entity Expansion issues.

Patches

Upgrade to version 2.1.0.

Workarounds

No known workaround.

References

https://github.com/monitorjbl/excel-streaming-reader/commit/0749c7b9709db078ccdeada16d46a34bc2910c73

For more information

If you have any questions or comments about this advisory:

Open an issue in monitorjbl/excel-streaming-reader

NVD description

Excel-Streaming-Reader is an easy-to-use implementation of a streaming Excel reader using Apache POI. Prior to xlsx-streamer 2.1.0, the XML parser that was used did apply all the necessary settings to prevent XML Entity Expansion issues. Upgrade to version 2.1.0 to receive a patch. There is no known workaround.

References

monitorjbl/excel-streaming-reader security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2022-23640 · ADVISORY
monitorjbl/excel-streaming-reader commit 0749c7b · WEB
monitorjbl/excel-streaming-reader · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

com.monitorjbl:xlsx-streamer

Maven

< 2.1.0

2.1.0

excel streaming reader

excel_streaming_reader_project

< 2.1.0

2.1.0

Description

Impact

Prior to xlsx-streamer 2.1.0, the XML parser that was used did not apply all the necessary settings to prevent XML Entity Expansion issues.

Patches

Upgrade to version 2.1.0.

Workarounds

No known workaround.

References

https://github.com/monitorjbl/excel-streaming-reader/commit/0749c7b9709db078ccdeada16d46a34bc2910c73

For more information

If you have any questions or comments about this advisory:

Open an issue in monitorjbl/excel-streaming-reader

NVD description