Strix
26.1K

CVE-2019-12415

MEDIUMCVSS 5.5/10EPSS 0.99%

Last modified

CVE-2019-12415 is a medium-severity vulnerability rated 5.5/10 on the CVSS scale. In Apache POI up to 4.1.0, when using the tool XSSFExportToXml to convert user-provided Microsoft Excel documents, a specially crafted document can allow an attacker to read files from the local filesystem or from internal network resources via XML External Entity (XXE) Processing.. EPSS estimates a 0.99% chance of exploitation in the next 30 days.

Description

In Apache POI up to 4.1.0, when using the tool XSSFExportToXml to convert user-provided Microsoft Excel documents, a specially crafted document can allow an attacker to read files from the local filesystem or from internal network resources via XML External Entity (XXE) Processing.

Metrics

CVSS 3.1
5.5/10

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

EPSS Probability
0.99%

58.0th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

VendorProductVersionsUpdate
ApachePoi<= 4.1.0—
OracleApplication Testing Suite12.5.0.3—
OracleApplication Testing Suite13.1.0.1—
OracleApplication Testing Suite13.2.0.1—
OracleApplication Testing Suite13.3.0.1—
OracleBanking Enterprise Originations2.7.0—
OracleBanking Enterprise Originations2.8.0—
OracleBanking Enterprise Product Manufacturing2.7.0—
OracleBanking Enterprise Product Manufacturing2.8.0—
OracleBanking Payments14.0.0—
OracleBanking Payments14.1.0—
OracleBanking Platform2.4.0—
OracleBanking Platform2.4.1—
OracleBanking Platform2.5.0—
OracleBanking Platform2.6.0—
OracleBanking Platform2.6.1—
OracleBanking Platform2.6.2—
OracleBanking Platform2.7.0—
OracleBanking Platform2.7.1—
OracleBanking Platform2.9.0—
OracleBig Data Discovery1.6—
OracleCommunications Diameter Signaling Router Idih\All versions8.0.0
OracleEndeca Information Discovery Studio3.2.0—
OracleEnterprise Manager Base Platform12.1.0.5—
OracleEnterprise Manager Base Platform13.3.0.0—
OracleEnterprise Manager Base Platform13.4.0.0—
OracleEnterprise Repository12.1.3.0.0—
OracleFinancial Services Analytical Applications Infrastructure>= 8.0.6, <= 8.0.9—
OracleFinancial Services Market Risk Measurement And Management8.0.6—
OracleFinancial Services Market Risk Measurement And Management8.0.8—
OracleFlexcube Private Banking12.0.0—
OracleFlexcube Private Banking12.1.0—
OracleHyperion Infrastructure Technology11.1.2.4—
OracleInstantis Enterprisetrack17.1—
OracleInstantis Enterprisetrack17.2—
OracleInstantis Enterprisetrack17.3—
OracleInsurance Policy Administration J2ee11.0.2—
OracleInsurance Policy Administration J2ee11.1.0—
OracleInsurance Policy Administration J2ee11.2.0—
OracleInsurance Rules Palette10.2.0—
OracleInsurance Rules Palette10.2.4—
OracleInsurance Rules Palette11.0.2—
OracleInsurance Rules Palette11.1.0—
OracleInsurance Rules Palette11.2.0—
OracleJdeveloper12.2.1.4.0—
OraclePeoplesoft Enterprise Peopletools8.57—
OraclePeoplesoft Enterprise Peopletools8.58—
OraclePeoplesoft Enterprise Peopletools8.59—
OraclePrimavera Gateway17.12.6—
OraclePrimavera Gateway18.8.8.1—

Showing 50 of 64 affected configurations. See NVD for the full list.

References

Timeline

Published
Last Modified
Status
Modified

Frequently Asked Questions

What is CVE-2019-12415?
In Apache POI up to 4.1.0, when using the tool XSSFExportToXml to convert user-provided Microsoft Excel documents, a specially crafted document can allow an attacker to read files from the local filesystem or from internal network resources via XML External Entity (XXE) Processing.
How severe is CVE-2019-12415?
CVE-2019-12415 has a CVSS score of 5.5/10 (MEDIUM severity). The EPSS model estimates a 0.99% probability of exploitation in the next 30 days.
How do I fix CVE-2019-12415?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2019-12415?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST