Medium severity · published Oct 23, 2019
CVE-2019-12415
In Apache POI up to 4.1.0, when using the tool XSSFExportToXml to convert user-provided Microsoft Excel documents, a specially crafted document can allow an attacker to read files…
5.5
CVSS
1%
EPSS
No
On KEV
Description
In Apache POI up to 4.1.0, when using the tool XSSFExportToXml to convert user-provided Microsoft Excel documents, a specially crafted document can allow an attacker to read files from the local filesystem or from internal network resources via XML External Entity (XXE) Processing.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.0% · higher than 63% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AT
Application Testing Suite · Oracle
12.5.0.3; 13.1.0.1; 13.2.0.1; 13.3.0.1 · source: NVD
BE
Banking Enterprise Originations · Oracle
2.7.0; 2.8.0 · source: NVD
BE
Banking Enterprise Product Manufacturing · Oracle
2.7.0; 2.8.0 · source: NVD
BP
Banking Payments · Oracle
14.0.0; 14.1.0 · source: NVD
BP
Banking Platform · Oracle
2.4.0; 2.4.1; 2.5.0; 2.6.0; 2.6.1; 2.6.2; +3 more · source: NVD
BD
Big Data Discovery · Oracle
1.6 · source: NVD
CD
Communications Diameter Signaling Router Idih: · Oracle
8.0.0; 8.2.2 · source: NVD
EI
Endeca Information Discovery Studio · Oracle
3.2.0 · source: NVD
EM
Enterprise Manager Base Platform · Oracle
12.1.0.5; 13.3.0.0; 13.4.0.0 · source: NVD
ER
Enterprise Repository · Oracle
12.1.3.0.0 · source: NVD
FS
Financial Services Analytical Applications Infrastructure · Oracle
8.0.6 through 8.0.9 · source: NVD
FS
Financial Services Market Risk Measurement And Management · Oracle
8.0.6; 8.0.8 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-12415
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-12415
lists.apache.org
https://lists.apache.org/thread.html/13a54b6a03369cfb418a699180ffb83bd727320b6ddfec198b9b728e%40%3Cannounce.apache.org%3E
lists.apache.org
https://lists.apache.org/thread.html/2ac0327748de0c2b3c1c012481b79936797c711724e0b7da83cf564c%40%3Cuser.tika.apache.org%3E
lists.apache.org
https://lists.apache.org/thread.html/895164e03a3c327449069e2fd6ced0367561878b3ae6a8ec740c2007%40%3Cuser.tika.apache.org%3E
lists.apache.org
https://lists.apache.org/thread.html/d88b8823867033514d7ec05d66f88c70dc207604d3dcbd44fd88464c%40%3Cuser.tika.apache.org%3E
lists.apache.org
https://lists.apache.org/thread.html/r204ba2a9ea750f38d789d2bb429cc0925ad6133deea7cbc3001d96b5%40%3Csolr-user.lucene.apache.org%3E
Third Party Advisory
https://www.oracle.com//security-alerts/cpujul2021.html
More from Poi
7.5
CVE-2017-12626
Apache POI in versions prior to release 3.17 are vulnerable to Denial of Service Attacks: 1) Infinite Loops while parsing crafted WMF, EMF, MSG and macros (POI bugs 61338 and…
5.5
CVE-2022-26336
A shortcoming in the HMEF package of poi-scratchpad (Apache POI) allows an attacker to cause an Out of Memory exception
5.5
CVE-2017-5644
Apache POI in versions prior to release 3.15 allows remote attackers to cause a denial of service (CPU consumption) via a specially crafted OOXML file, aka an XML Entity Expansion…
5.5
CVE-2016-5000
The XLSX2CSV example in Apache POI before 3.14 allows remote attackers to read arbitrary files via a crafted OpenXML document containing an external entity declaration in…
5.3
CVE-2025-31672
Improper Input Validation vulnerability in Apache POI