CVE-2014-3574

mediumpriority · track · 19EPSS 0.071 · 94 %ileDEEUUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

7.11% (94th) EPSS

CVSS 4.3 · medium

Is it mine?

47 products

Check your exposure

Who says so?

6 sources

cnnvd · enisa_euvd · cert_bund · nvd

EPSS · scored 2026-10-27

Apache POI before 3.10.1 and 3.11.x before 3.11-beta2 allows remote attackers to cause a denial of service (CPU consumption and crash) via a crafted OOXML file, aka an XML Entity Expansion (XEE) attack.

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

FixedRed Hat JBoss Fuse Service Works 6.0redhat_csaf
The References section of this erratum contains a download link (you must log in to download the updates). Before applying the updates, back up your existing installation, including all applications, configuration files, databases and database settings, and so on. It is recommended to halt the server by stopping the JBoss Application Server process before installing this update, and then after installing the update, restart the server by starting the JBoss Application Server process.
https://access.redhat.com/errata/RHSA-2014:1370
FixedRed Hat JBoss Data Virtualization 6.0redhat_csaf
The References section of this erratum contains a download link (you must log in to download the updates). Before applying the updates, back up your existing installation, including all applications, configuration files, databases and database settings, and so on. It is recommended to halt the server by stopping the JBoss Application Server process before installing this update, and then after installing the update, restart the server by starting the JBoss Application Server process.
https://access.redhat.com/errata/RHSA-2014:1398
FixedRed Hat JBoss BPMS 6.0redhat_csaf
The References section of this erratum contains a download link (you must log in to download the updates). Before applying the updates, back up your existing installation, including all applications, configuration files, databases and database settings, and so on. It is recommended to halt the server by stopping the JBoss Application Server process before installing this update, and then after installing the update, restart the server by starting the JBoss Application Server process.
https://access.redhat.com/errata/RHSA-2014:1399
FixedRed Hat JBoss BRMS 6.0redhat_csaf
The References section of this erratum contains a download link (you must log in to download the updates). Before applying the updates, back up your existing installation, including all applications, configuration files, databases and database settings, and so on. It is recommended to halt the server by stopping the JBoss Application Server process before installing this update, and then after installing the update, restart the server by starting the JBoss Application Server process.
https://access.redhat.com/errata/RHSA-2014:1400

cvss

Technical severity, 0–10. One row per scoring source.

5.0

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · low–medium · 3.7–5

v2.04.3mediumAV:N/AC:M/Au:N/C:N/I:N/A:Pprimary · NVD / NIST USexploitability 8.6 · impact 2.9

v2.03.7lowAV:N/AC:M/Au:N/C:N/I:N/A:P/E:Usecondary · CVSS-BT (t0sche)

v2.05mediumAV:N/AC:L/Au:N/C:N/I:N/A:Psecondary · Red Hat Product Security US

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-20US

affected products (47)

Products and version ranges known to be affected.

Dell Data Protection Advisor <19.12 SP2all versionscert_bundDE
Dell Data Protection Advisor< 19.12 SP2cert_bundDE
n/a n/a≤ n/aenisa_euvdEU
apache poi≤ 3.10nvdUScpe:2.3:a:apache:poi:*:*:*:*:*:*:*:*
apache poi= 0.1nvdUScpe:2.3:a:apache:poi:*:*:*:*:*:*:*:*
apache poi= 0.10.0nvdUScpe:2.3:a:apache:poi:*:*:*:*:*:*:*:*
apache poi= 0.11.0nvdUScpe:2.3:a:apache:poi:*:*:*:*:*:*:*:*
apache poi= 0.12.0nvdUScpe:2.3:a:apache:poi:*:*:*:*:*:*:*:*
apache poi= 0.13.0nvdUScpe:2.3:a:apache:poi:*:*:*:*:*:*:*:*
apache poi= 0.14.0nvdUScpe:2.3:a:apache:poi:*:*:*:*:*:*:*:*
apache poi= 0.2nvdUScpe:2.3:a:apache:poi:*:*:*:*:*:*:*:*
apache poi= 0.3nvdUScpe:2.3:a:apache:poi:*:*:*:*:*:*:*:*
apache poi= 0.4nvdUScpe:2.3:a:apache:poi:*:*:*:*:*:*:*:*
apache poi= 0.5nvdUScpe:2.3:a:apache:poi:*:*:*:*:*:*:*:*
apache poi= 0.6nvdUScpe:2.3:a:apache:poi:*:*:*:*:*:*:*:*
apache poi= 0.7nvdUScpe:2.3:a:apache:poi:*:*:*:*:*:*:*:*
apache poi= 1.0.0nvdUScpe:2.3:a:apache:poi:*:*:*:*:*:*:*:*
apache poi= 1.0.1nvdUScpe:2.3:a:apache:poi:*:*:*:*:*:*:*:*
apache poi= 1.0.2nvdUScpe:2.3:a:apache:poi:*:*:*:*:*:*:*:*
apache poi= 1.1.0nvdUScpe:2.3:a:apache:poi:*:*:*:*:*:*:*:*

showing 20 of 47

advisories (6)

Vendor and ecosystem advisories describing this.

RHSA-2014:1370Red Hat Security Advisory: Apache POI security update2014-10-09csaf · redhat_csafUS
An update for the Apache POI component that fixes two security issues is now available from the Red Hat Customer Portal for Red Hat Fuse Service Works 6.0.0. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.
RHSA-2014:1398Red Hat Security Advisory: Apache POI security update2014-10-13csaf · redhat_csafUS
An update for the Apache POI component that fixes two security issues is now available from the Red Hat Customer Portal for Red Hat JBoss Data Virtualization 6.0.0. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.
RHSA-2014:1399Red Hat Security Advisory: Apache POI security update2014-10-13csaf · redhat_csafUS
An update for the Apache POI component that fixes two security issues is now available from the Red Hat Customer Portal for Red Hat JBoss BPM Suite 6.0.3. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.
RHSA-2014:1400Red Hat Security Advisory: Apache POI security update2014-10-13csaf · redhat_csafUS
An update for the Apache POI component that fixes two security issues is now available from the Red Hat Customer Portal for Red Hat JBoss BRMS 6.0.3. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.
WID-SEC-W-2026-0180Dell Data Protection Advisor: Mehrere SchwachstellenDeutsch2026-01-20csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in Dell Data Protection Advisor ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand zu erzeugen, Sicherheitsmaßnahmen zu umgehen und nicht näher spezifizierte Angriffe zu starten.
GHSA-5wfp-8643-c58xImproper Input Validation in Apache POI2022-05-17ghsa · osvUS
Apache POI before 3.10.1 and 3.11.x before 3.11-beta2 allows remote attackers to cause a denial of service (CPU consumption and crash) via a crafted OOXML file, aka an XML Entity Expansion (XEE) attack.

also known as (3)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd cert_bund nvd redhat_csaf osv NVD CVE.org MITRE

published 2014-09-04modified 2026-06-17

references (30)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan