NetSight
IP …
medium5.5

CVE-2019-12415

Improper Restriction of XML External Entity Reference in Apache POI

Impact

In Apache POI up to 4.1.0, when using the tool XSSFExportToXml to convert user-provided Microsoft Excel documents, a specially crafted document can allow an attacker to read files from the local filesystem or from internal network resources via XML External Entity (XXE) Processing.

Affected packages

EcosystemPackageAffectedFixed in
mavenorg.apache.poi:poi<= 4.1.04.1.1

Affected products

VendorProductAffected versions
ApachePoi
through 4.1.0
OracleApplication Testing Suite
Versions 12.5.0.3, 13.1.0.1, 13.2.0.1, 13.3.0.1
OracleBanking Enterprise Originations
Versions 2.7.0, 2.8.0
OracleBanking Enterprise Product Manufacturing
Versions 2.7.0, 2.8.0
OracleBanking Payments
Versions 14.0.0, 14.1.0
OracleBanking Platform
Versions 2.4.0, 2.4.1, 2.5.0, 2.6.0, 2.6.1, 2.6.2
OracleBig Data Discovery
Version 1.6
OracleCommunications Diameter Signaling Router Idih\
All versions
OracleEndeca Information Discovery Studio
Version 3.2.0
OracleEnterprise Manager Base Platform
Versions 12.1.0.5, 13.3.0.0, 13.4.0.0
OracleEnterprise Repository
Version 12.1.3.0.0
OracleFinancial Services Analytical Applications Infrastructure
from 8.0.6 through 8.0.9

Weakness classification

CWE-611

References