CVE-2019-12415

—

CVSS 3.1

5.5 medium

EPSS

<1%p60

Published

Oct 23, 2019 (Oct 23, 2019)

Modified

Jun 17, 2026

Description

In Apache POI up to 4.1.0, when using the tool XSSFExportToXml to convert user-provided Microsoft Excel documents, a specially crafted document can allow an attacker to read files from the local filesystem or from internal network resources via XML External Entity (XXE) Processing.

Vendors: apache oracle
Products: poi, application testing suite, banking enterprise originations, banking enterprise product manufacturing, banking payments, banking platform, big data discovery, communications diameter signaling router idih\, endeca information discovery studio, enterprise manager base platform, enterprise repository, financial services analytical applications infrastructure
Weakness: CWE-611
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

NVD CVE.org GitHub PoCs EPSS (1.0%)

In the news0 stories

No ingested article mentions this CVE yet.