CVE-2019-12415

CVSS v3.1 5.5 (Medium)

CVSS v2.0 2.1 (Low)

EPSS 0.10 % (41^th)

Affected Products 27

Advisories 1

In Apache POI up to 4.1.0, when using the tool XSSFExportToXml to convert user-provided Microsoft Excel documents, a specially crafted document can allow an attacker to read files from the local filesystem or from internal network resources via XML External Entity (XXE) Processing.

Weaknesses

CWE-611: Improper Restriction of XML External Entity Reference

CVE Status: PUBLISHED
CNA: Apache Software Foundation
Published Date: 2019-10-23 20:15:12
(4 years ago)
Updated Date: 2023-11-07 03:03:34
(10 months ago)

Affected Products

Apache

Oracle

Configuration #1

		CPE23	From	Up To
	Apache Poi 4.1.0 and prior versions	cpe:2.3:a:apache:poi		<= 4.1.0

Configuration #2

	CPE23	From	Up To
Oracle Application Testing Suite 12.5.0.3	cpe:2.3:a:oracle:application_testing_suite:12.5.0.3
Oracle Application Testing Suite 13.1.0.1	cpe:2.3:a:oracle:application_testing_suite:13.1.0.1
Oracle Application Testing Suite 13.2.0.1	cpe:2.3:a:oracle:application_testing_suite:13.2.0.1
Oracle Application Testing Suite 13.3.0.1	cpe:2.3:a:oracle:application_testing_suite:13.3.0.1
Oracle Banking Enterprise Originations 2.7.0	cpe:2.3:a:oracle:banking_enterprise_originations:2.7.0
Oracle Banking Enterprise Originations 2.8.0	cpe:2.3:a:oracle:banking_enterprise_originations:2.8.0
Oracle Banking Enterprise Product Manufacturing 2.7.0	cpe:2.3:a:oracle:banking_enterprise_product_manufacturing:2.7.0
Oracle Banking Enterprise Product Manufacturing 2.8.0	cpe:2.3:a:oracle:banking_enterprise_product_manufacturing:2.8.0
Oracle Banking Payments 14.0.0	cpe:2.3:a:oracle:banking_payments:14.0.0
Oracle Banking Payments 14.1.0	cpe:2.3:a:oracle:banking_payments:14.1.0
Oracle Banking Platform 2.4.0	cpe:2.3:a:oracle:banking_platform:2.4.0
Oracle Banking Platform 2.4.1	cpe:2.3:a:oracle:banking_platform:2.4.1
Oracle Banking Platform 2.5.0	cpe:2.3:a:oracle:banking_platform:2.5.0
Oracle Banking Platform 2.6.0	cpe:2.3:a:oracle:banking_platform:2.6.0
Oracle Banking Platform 2.6.1	cpe:2.3:a:oracle:banking_platform:2.6.1
Oracle Banking Platform 2.6.2	cpe:2.3:a:oracle:banking_platform:2.6.2
Oracle Banking Platform 2.7.0	cpe:2.3:a:oracle:banking_platform:2.7.0
Oracle Banking Platform 2.7.1	cpe:2.3:a:oracle:banking_platform:2.7.1
Oracle Banking Platform 2.9.0	cpe:2.3:a:oracle:banking_platform:2.9.0
Oracle Big Data Discovery 1.6	cpe:2.3:a:oracle:big_data_discovery:1.6
Oracle Communications Diameter Signaling Router Idih: 8.0.0	cpe:2.3:a:oracle:communications_diameter_signaling_router_idih\::8.0.0
Oracle Communications Diameter Signaling Router Idih: 8.2.2	cpe:2.3:a:oracle:communications_diameter_signaling_router_idih\::8.2.2
Oracle Endeca Information Discovery Studio 3.2.0	cpe:2.3:a:oracle:endeca_information_discovery_studio:3.2.0
Oracle Enterprise Manager Base Platform 12.1.0.5	cpe:2.3:a:oracle:enterprise_manager_base_platform:12.1.0.5
Oracle Enterprise Manager Base Platform 13.3.0.0	cpe:2.3:a:oracle:enterprise_manager_base_platform:13.3.0.0
Oracle Enterprise Manager Base Platform 13.4.0.0	cpe:2.3:a:oracle:enterprise_manager_base_platform:13.4.0.0
Oracle Enterprise Repository 12.1.3.0.0	cpe:2.3:a:oracle:enterprise_repository:12.1.3.0.0
Oracle Financial Services Analytical Applications Infrastructure from 8.0.6 version and 8.0.9 and prior versions	cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure	>= 8.0.6	<= 8.0.9
Oracle Financial Services Market Risk Measurement And Management 8.0.6	cpe:2.3:a:oracle:financial_services_market_risk_measurement_and_management:8.0.6
Oracle Financial Services Market Risk Measurement And Management 8.0.8	cpe:2.3:a:oracle:financial_services_market_risk_measurement_and_management:8.0.8
Oracle Flexcube Private Banking 12.0.0	cpe:2.3:a:oracle:flexcube_private_banking:12.0.0
Oracle Flexcube Private Banking 12.1.0	cpe:2.3:a:oracle:flexcube_private_banking:12.1.0
Oracle Hyperion Infrastructure Technology 11.1.2.4	cpe:2.3:a:oracle:hyperion_infrastructure_technology:11.1.2.4
Oracle Instantis Enterprisetrack 17.1	cpe:2.3:a:oracle:instantis_enterprisetrack:17.1
Oracle Instantis Enterprisetrack 17.2	cpe:2.3:a:oracle:instantis_enterprisetrack:17.2
Oracle Instantis Enterprisetrack 17.3	cpe:2.3:a:oracle:instantis_enterprisetrack:17.3
Oracle Insurance Policy Administration J2ee 11.0.2	cpe:2.3:a:oracle:insurance_policy_administration_j2ee:11.0.2
Oracle Insurance Policy Administration J2ee 11.1.0	cpe:2.3:a:oracle:insurance_policy_administration_j2ee:11.1.0
Oracle Insurance Policy Administration J2ee 11.2.0	cpe:2.3:a:oracle:insurance_policy_administration_j2ee:11.2.0
Oracle Insurance Rules Palette 10.2.0	cpe:2.3:a:oracle:insurance_rules_palette:10.2.0
Oracle Insurance Rules Palette 10.2.4	cpe:2.3:a:oracle:insurance_rules_palette:10.2.4
Oracle Insurance Rules Palette 11.0.2	cpe:2.3:a:oracle:insurance_rules_palette:11.0.2
Oracle Insurance Rules Palette 11.1.0	cpe:2.3:a:oracle:insurance_rules_palette:11.1.0
Oracle Insurance Rules Palette 11.2.0	cpe:2.3:a:oracle:insurance_rules_palette:11.2.0
Oracle Jdeveloper 12.2.1.4.0	cpe:2.3:a:oracle:jdeveloper:12.2.1.4.0
Oracle Peoplesoft Enterprise Peopletools 8.57	cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.57
Oracle Peoplesoft Enterprise Peopletools 8.58	cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58
Oracle Peoplesoft Enterprise Peopletools 8.59	cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.59
Oracle Primavera Gateway 17.12.6	cpe:2.3:a:oracle:primavera_gateway:17.12.6
Oracle Primavera Gateway 18.8.8.1	cpe:2.3:a:oracle:primavera_gateway:18.8.8.1
Oracle Primavera Unifier from 17.7 version and 17.12 and prior versions	cpe:2.3:a:oracle:primavera_unifier	>= 17.7	<= 17.12
Oracle Primavera Unifier 16.1	cpe:2.3:a:oracle:primavera_unifier:16.1
Oracle Primavera Unifier 16.2	cpe:2.3:a:oracle:primavera_unifier:16.2
Oracle Primavera Unifier 18.8	cpe:2.3:a:oracle:primavera_unifier:18.8
Oracle Primavera Unifier 19.12	cpe:2.3:a:oracle:primavera_unifier:19.12
Oracle Retail Clearance Optimization Engine 14.0	cpe:2.3:a:oracle:retail_clearance_optimization_engine:14.0
Oracle Retail Order Broker 15.0	cpe:2.3:a:oracle:retail_order_broker:15.0
Oracle Retail Order Broker 16.0	cpe:2.3:a:oracle:retail_order_broker:16.0
Oracle Retail Predictive Application Server 15.0.3	cpe:2.3:a:oracle:retail_predictive_application_server:15.0.3
Oracle Retail Predictive Application Server 16.0.3	cpe:2.3:a:oracle:retail_predictive_application_server:16.0.3
Oracle Webcenter Portal 12.2.1.3.0	cpe:2.3:a:oracle:webcenter_portal:12.2.1.3.0
Oracle Webcenter Portal 12.2.1.4.0	cpe:2.3:a:oracle:webcenter_portal:12.2.1.4.0
Oracle Webcenter Sites 12.2.1.3.0	cpe:2.3:a:oracle:webcenter_sites:12.2.1.3.0
Oracle Webcenter Sites 12.2.1.4.0	cpe:2.3:a:oracle:webcenter_sites:12.2.1.4.0