XXE in Apache Poi
CVE-2019-12415
In Apache POI up to 4.1.0, when using the tool XSSFExportToXml to convert user-provided Microsoft Excel documents, a specially crafted document can allow an attacker to read files from the local filesystem or from internal network resources via XML External Entity (XXE) Processing.
Vulnerability class: XXE (XML External Entity)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 5.5 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N.
EPSS exploit prediction
EPSS: 0.010 (62.8th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 63rd percentile — 62.8% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.010 · newest: 0.010 · change: 0.000
Affected products
- Apache Poi
- Oracle Application Testing Suite — versions 12.5.0.3, 13.1.0.1, 13.2.0.1
- Oracle Banking Enterprise Originations — versions 2.7.0, 2.8.0
- Oracle Banking Enterprise Product Manufacturing — versions 2.7.0, 2.8.0
- Oracle Banking Payments — versions 14.0.0, 14.1.0
- Oracle Banking Platform — versions 2.4.0, 2.4.1, 2.5.0
- Oracle Big Data Discovery — versions 1.6
- Oracle Communications Diameter Signaling Router Idih\
- Oracle Communications Diameter Signaling Router Idih\: — versions 8.0.0, 8.2.2
- Oracle Endeca Information Discovery Studio — versions 3.2.0
Weakness classification (CWE)
Public proof-of-concept exploits
References
- lists.apache.org/thread.html/2ac0327748de0c2b3c1c012481b79936797c711724e0b7da83… (mailing-list)
- lists.apache.org/thread.html/895164e03a3c327449069e2fd6ced0367561878b3ae6a8ec74… (mailing-list)
- lists.apache.org/thread.html/d88b8823867033514d7ec05d66f88c70dc207604d3dcbd44fd… (mailing-list)
- lists.apache.org/thread.html/r204ba2a9ea750f38d789d2bb429cc0925ad6133deea7cbc30… (mailing-list)
- www.oracle.com/security-alerts/cpuapr2020.html (Third Party Advisory)
- www.oracle.com/security-alerts/cpujul2020.html (Third Party Advisory)
- www.oracle.com/security-alerts/cpujan2020.html (Third Party Advisory)
- lists.apache.org/thread.html/13a54b6a03369cfb418a699180ffb83bd727320b6ddfec198b…
- www.oracle.com/security-alerts/cpuoct2020.html (Third Party Advisory)
- www.oracle.com/security-alerts/cpujan2021.html (Third Party Advisory)
Frequently asked questions
- What is CVE-2019-12415?
- CVE-2019-12415 is a medium-severity vulnerability in Apache Poi, classified under Improper Restriction of XML External Entity Reference (XXE). CVSS score: 5.5/10. Published 2019-10-23.
- How severe is CVE-2019-12415?
- Medium severity. CVSS v3 base score is 5.5 out of 10.
- Is CVE-2019-12415 known to be exploited?
- 6 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.