GHSA-pmqq-7wfv-jfff

ghsaUSosv

Apache POI's XLSX2CSV Example XML External Entity (XXE) Vulnerability

view advisory published 2022-05-13Licence: CC-BY-4.0

The XLSX2CSV example in Apache POI before 3.14 allows remote attackers to read arbitrary files via a crafted OpenXML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2016-5000US	medium5.5	4.15% (91st)	—	2016-08-05
The XLSX2CSV example in Apache POI before 3.14 allows remote attackers to read arbitrary files via a crafted OpenXML document containing an external entity declaration in conjuncti…

references

External citations — patches, advisories, analysis.

http://www-01.ibm.com/support/docview.wss?uid=swg21996759WEB
https://lists.apache.org/list.html?user@poi.apache.orgWEB
https://nvd.nist.gov/vuln/detail/CVE-2016-5000ADVISORY
https://www.oracle.com/security-alerts/cpuoct2020.htmlWEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan