GHSA-q56h-jjj6-52mf

ghsaUSosv

Improper Restriction of XML External Entity Reference in Apache POI

view advisory published 2022-05-17Licence: CC-BY-4.0

The OPC SAX setup in Apache POI before 3.10.1 allows remote attackers to read arbitrary files via an OpenXML file containing an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2014-3529US	medium4.3	12.8% (96th)	—	2014-09-04
The OPC SAX setup in Apache POI before 3.10.1 allows remote attackers to read arbitrary files via an OpenXML file containing an XML external entity declaration in conjunction with…

references

External citations — patches, advisories, analysis.

http://poi.apache.org/changes.htmlWEB
http://rhn.redhat.com/errata/RHSA-2014-1370.htmlWEB
http://rhn.redhat.com/errata/RHSA-2014-1398.htmlWEB
http://rhn.redhat.com/errata/RHSA-2014-1399.htmlWEB
http://rhn.redhat.com/errata/RHSA-2014-1400.htmlWEB
http://www-01.ibm.com/support/docview.wss?uid=swg21996759WEB
http://www.apache.org/dist/poi/release/RELEASE-NOTES.txtWEB
https://exchange.xforce.ibmcloud.com/vulnerabilities/95770WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan