PT-2019-4677 · Apache+1 · Apache Poi+1

Publicado 2019-10-20 · Atualizado 2022-05-24 · CVE-2019-12415

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Média

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache POI versions up to 4.1.0

Description The issue is related to the XSSFExportToXml tool in Apache POI, which can be exploited to read files from the local filesystem or internal network resources via XML External Entity (XXE) Processing when converting user-provided Microsoft Excel documents. This is due to insufficient restrictions on XML external entities.

Recommendations For Apache POI versions up to 4.1.0, consider disabling the XSSFExportToXml tool until a patch is available to prevent potential exploitation. Restrict access to sensitive files and network resources to minimize the risk of unauthorized access.

Exploit

Correção

XXE

Enumeração de Fraquezas

CWE-611

Identificadores relacionados

BDU:2020-00970

CVE-2019-12415

GHSA-9JWC-Q6J3-8G9G

Produtos afetados

Apache Poi

Debian

Referências · 33

• 🔥 https://blog.gypsyengineer.com/en/security/cve-2019-12415-xml-processing-vulnerability-in-apache-poi.html · Exploit
• https://github.com/apache/poi · Nota
• https://lists.apache.org/thread.html/r204ba2a9ea750f38d789d2bb429cc0925ad6133deea7cbc3001d96b5%40%3Csolr-user.lucene.apache.org%3E · Nota
• https://oracle.com/security-alerts/cpujul2020.html · Nota
• https://osv.dev/vulnerability/CVE-2019-12415 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2020-00970 · Nota de Segurança
• https://oracle.com/security-alerts/cpujan2020.html · Nota
• https://osv.dev/vulnerability/GHSA-9jwc-q6j3-8g9g · Aviso do Fabricante
• https://lists.apache.org/thread.html/d88b8823867033514d7ec05d66f88c70dc207604d3dcbd44fd88464c@%3Cuser.tika.apache.org%3E · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-12415 · Nota de Segurança
• https://oracle.com/security-alerts/cpuoct2021.html · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-12415 · Nota de Segurança
• https://openwall.com/lists/oss-security/2019/10/23/1 · Nota
• https://ubuntu.com/security/CVE-2019-12415 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2019-12415 · Nota de Segurança