What is the CVSS score of CVE-2019-12415?

CVE-2019-12415 has a CVSS 3.1 base score of 5.5 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 1.0%.

Is there a patch available for CVE-2019-12415?

Yes, a patch is available for CVE-2019-12415. Update the affected software to the latest version immediately.

Poi CVE-2019-12415

MEDIUM

Improper Restriction of XML External Entity Reference (CWE-611)

2019-10-23 security@apache.org

XXE Microsoft Apache Poi Application Testing Suite Banking Enterprise Originations Banking Enterprise Product Manufacturing Banking Payments Banking Platform Big Data Discovery Communications Diameter Signaling Router Idih Endeca Information Discovery Studio Enterprise Manager Base Platform Enterprise Repository Financial Services Analytical Applications Infrastructure Financial Services Market Risk Measurement And Management Flexcube Private Banking Hyperion Infrastructure Technology Instantis Enterprisetrack Insurance Policy Administration J2Ee Insurance Rules Palette Jdeveloper Peoplesoft Enterprise Peopletools Primavera Gateway Primavera Unifier Retail Clearance Optimization Engine Retail Order Broker Retail Predictive Application Server Webcenter Portal Webcenter Sites

5.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

CVE Published

Oct 23, 2019 - 20:15 nvd

MEDIUM 5.5

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

747 maven packages depend on org.apache.poi:poi (125 direct, 623 indirect)

Ecosystem-wide dependent count for version 4.1.1.

DescriptionNVD

In Apache POI up to 4.1.0, when using the tool XSSFExportToXml to convert user-provided Microsoft Excel documents, a specially crafted document can allow an attacker to read files from the local filesystem or from internal network resources via XML External Entity (XXE) Processing.

AnalysisAI

In Apache POI up to 4.1.0, when using the tool XSSFExportToXml to convert user-provided Microsoft Excel documents, a specially crafted document can allow an attacker to read files from the local. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified as XML External Entity (XXE) (CWE-611), which allows attackers to read arbitrary files or perform SSRF through XML processing. In Apache POI up to 4.1.0, when using the tool XSSFExportToXml to convert user-provided Microsoft Excel documents, a specially crafted document can allow an attacker to read files from the local filesystem or from internal network resources via XML External Entity (XXE) Processing. Affected products include: Apache Poi, Oracle Application Testing Suite, Oracle Banking Enterprise Originations, Oracle Banking Enterprise Product Manufacturing, Oracle Banking Payments. Version information: up to 4.1.0.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Disable external entity processing in XML parsers, use JSON instead of XML where possible.