| Package | Affected versions | Patched versions |
|---|---|---|
| org.apache.poi:poi | ≥ 3.11-beta1, < 3.11-beta2< 3.10.1 | 3.11-beta23.10.1 |
| poi | = 0.1= 0.10.0= 0.11.0= 0.12.0= 0.13.0= 0.14.0= 0.2= 0.3= 0.4= 0.5= 0.6= 0.7= 1.0.0= 1.0.1= 1.0.2= 1.1.0= 1.10= 1.2.0= 1.5= 1.5.1= 1.7= 1.8= 2.0= 2.5= 2.5.1= 3.0= 3.0.1= 3.0.2= 3.1= 3.10= 3.11= 3.2= 3.5= 3.6= 3.7= 3.8= 3.9≤ 3.10 |
Apache POI before 3.10.1 and 3.11.x before 3.11-beta2 allows remote attackers to cause a denial of service (CPU consumption and crash) via a crafted OOXML file, aka an XML Entity Expansion (XEE) attack.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free