CVE-2019-12415 Improper Restriction of XML External Entity Reference in Apache POI
Attackers can read local files or internal network resources by crafting malicious Excel documents processed by Apache POI's XSSFExportToXml tool.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2019-12415?
CVE-2019-12415 is a medium-severity vulnerability in Oracle Application Testing Suite, published on 23 Oct 2019. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In Apache POI up to 4.1.0, when using the tool XSSFExportToXml to convert user-provided Microsoft Excel documents, a specially crafted document can allow an attacker to read files from the local filesystem or from internal network resources via XML External Entity (XXE) Processing.
Weakness: CWE-611
Which versions are affected by CVE-2019-12415?
2 open source packages ship an affected version, including org.apache.poi:poi. It affects 27 products.
| Package | Affected | Fixed in |
|---|---|---|
org.apache.poi:poi Maven | All versions | 4.1.1 |
org.apache.poi:poi Maven | All versions | 4.1.1 |
Products include Apache Poi, Oracle Application Testing Suite, Oracle Banking Enterprise Originations, Oracle Banking Enterprise Product Manufacturing, Oracle Banking Payments, Oracle Banking Platform and 21 more.
How do I fix CVE-2019-12415?
Upgrade org.apache.poi:poi to 4.1.1 or later.
Is CVE-2019-12415 being exploited?
There is no known exploitation of CVE-2019-12415 in the wild and no public exploit code.
Other vulnerabilities in Oracle Application Testing Suite
- CVE-2017-12626 Denial of Service in Apache POI
- CVE-2022-26336 A carefully crafted TNEF file can cause an out of memory exception
- CVE-2017-5644 Improper Restriction of Recursive Entity References in DTDs in Apache POI
- CVE-2016-5000 Apache POI's XLSX2CSV Example XML External Entity (XXE) Vulnerability
- CVE-2025-31672 Apache POI OOXML Vulnerable to Improper Input Validation in OOXML File Parsing
Sources
Also known as DEBIAN-CVE-2019-12415, GHSA-9jwc-q6j3-8g9g, UBUNTU-CVE-2019-12415.