CVE-2019-12415

5.5MEDIUM

Key Information:

Vendor
Apache
Status
Apache Poi
Vendor
CVE Published:
23 October 2019

Summary

In Apache POI up to 4.1.0, when using the tool XSSFExportToXml to convert user-provided Microsoft Excel documents, a specially crafted document can allow an attacker to read files from the local filesystem or from internal network resources via XML External Entity (XXE) Processing.

Affected Version(s)

Apache POI Apache POI up to 4.1.0

References

https://lists.apache.org/thread.html/2ac0327748de0c2b3c1c...
mailing-listx_refsource_MLIST
https://lists.apache.org/thread.html/895164e03a3c32744906...
mailing-listx_refsource_MLIST
https://lists.apache.org/thread.html/d88b8823867033514d7e...
mailing-listx_refsource_MLIST

CVSS V3.1

Score:
5.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.