Improper Restriction of XML External Entity Reference in Apache POI

中危 5.5CVE-2019-12415 · GHSA-9jwc-q6j3-8g9g · Published 23/10/2019 · updated 17/06/2026

要点

CVE-2019-12415 是影响 org.apache.poi:poi, poi (apache), application testing suite (oracle) 的中危 (CVSS 5.5)漏洞。
未来 30 天内被利用的概率（EPSS）：1.00%，高于 62.8% 的漏洞。
修复：升级到 4.1.1 或更高版本。

Package	Affected versions	Patched versions
org.apache.poi:poi Maven	`< 4.1.1`	`4.1.1`
poi apache	`≤ 4.1.0`	No fix yet
application testing suite oracle	`= 12.5.0.3= 13.1.0.1= 13.2.0.1= 13.3.0.1`	No fix yet
banking enterprise originations oracle	`= 2.7.0= 2.8.0`	No fix yet
banking enterprise product manufacturing oracle	`= 2.7.0= 2.8.0`	No fix yet
banking payments oracle	`= 14.0.0= 14.1.0`	No fix yet
banking platform oracle	`= 2.4.0= 2.4.1= 2.5.0= 2.6.0= 2.6.1= 2.6.2= 2.7.0= 2.7.1= 2.9.0`	No fix yet
big data discovery oracle	`= 1.6`	No fix yet
communications diameter signaling router idih oracle	`= 8.0.0= 8.2.2`	No fix yet
endeca information discovery studio oracle	`= 3.2.0`	No fix yet
enterprise manager base platform oracle	`= 12.1.0.5= 13.3.0.0= 13.4.0.0`	No fix yet
enterprise repository oracle	`= 12.1.3.0.0`	No fix yet
financial services analytical applications infrastructure oracle	`≥ 8.0.6, ≤ 8.0.9`	No fix yet
financial services market risk measurement and management oracle	`= 8.0.6= 8.0.8`	No fix yet
flexcube private banking oracle	`= 12.0.0= 12.1.0`	No fix yet
hyperion infrastructure technology oracle	`= 11.1.2.4`	No fix yet
instantis enterprisetrack oracle	`= 17.1= 17.2= 17.3`	No fix yet
insurance policy administration j2ee oracle	`= 11.0.2= 11.1.0= 11.2.0`	No fix yet
insurance rules palette oracle	`= 10.2.0= 10.2.4= 11.0.2= 11.1.0= 11.2.0`	No fix yet
jdeveloper oracle	`= 12.2.1.4.0`	No fix yet
peoplesoft enterprise peopletools oracle	`= 8.57= 8.58= 8.59`	No fix yet
primavera gateway oracle	`= 17.12.6= 18.8.8.1`	No fix yet
primavera unifier oracle	`= 16.1= 16.2= 18.8= 19.12≥ 17.7, ≤ 17.12`	No fix yet
retail clearance optimization engine oracle	`= 14.0`	No fix yet
retail order broker oracle	`= 15.0= 16.0`	No fix yet
retail predictive application server oracle	`= 15.0.3= 16.0.3`	No fix yet
webcenter portal oracle	`= 12.2.1.3.0= 12.2.1.4.0`	No fix yet
webcenter sites oracle	`= 12.2.1.3.0= 12.2.1.4.0`	No fix yet

Description

In Apache POI up to 4.1.0, when using the tool XSSFExportToXml to convert user-provided Microsoft Excel documents, a specially crafted document can allow an attacker to read files from the local filesystem or from internal network resources via XML External Entity (XXE) Processing.

NVD description

References

org.apache.poi:poi 的其他漏洞

查看全部 →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free