CVE-2019-12415GHSA-9JWC-Q6J3-8G9G
In Apache POI up to 4.1.0, when using the tool XSSFExportToXml to convert user-provided Microsoft Excel documents, a specially crafted docum
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 4.1.1
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
In Apache POI up to 4.1.0, when using the tool XSSFExportToXml to convert user-provided Microsoft Excel documents, a specially crafted document can allow an attacker to read files from the local filesystem or from internal network resources via XML External Entity (XXE) Processing.
Timeline
- CVE published
- Record last updated
Affected versions
- n/a Apache POI
Apache POI up to 4.1.0
- org.apache.poi:poiMaven
fixed in 4.1.1
References 13
lists.apache.org
- thread.html/2ac0327748de0c2b3c1c012481b79936797c711724e0b7da83cf564c@<user.tika.apache.org>
- thread.html/895164e03a3c327449069e2fd6ced0367561878b3ae6a8ec740c2007@<user.tika.apache.org>
- thread.html/d88b8823867033514d7ec05d66f88c70dc207604d3dcbd44fd88464c@<user.tika.apache.org>
- thread.html/r204ba2a9ea750f38d789d2bb429cc0925ad6133deea7cbc3001d96b5@<solr-user.lucene.apache.org>
- thread.html/13a54b6a03369cfb418a699180ffb83bd727320b6ddfec198b9b728e@<announce.apache.org>