# CVE-2019-12415: Improper Restriction of XML External Entity Reference in Apache POI

> Attackers can read local files or internal network resources by crafting malicious Excel documents processed by Apache POI's XSSFExportToXml tool.

- **Severity:** Medium 5.5 (`CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N`)
- **Exploited in the wild:** Not known
- **Login needed:** Any signed-in user
- **Attackable:** Local or same network only
- **Victim action needed:** Not needed
- **Fix available:** Yes
- **Published:** 23 Oct 2019
- **Updated:** 4 Aug 2024
- **Also known as:** DEBIAN-CVE-2019-12415, GHSA-9jwc-q6j3-8g9g, UBUNTU-CVE-2019-12415

## What is CVE-2019-12415?

CVE-2019-12415 is a medium-severity vulnerability in Oracle Application Testing Suite, published on 23 Oct 2019. It can only be exploited from the same machine or local network, with no action from the victim.

### Official description

In Apache POI up to 4.1.0, when using the tool XSSFExportToXml to convert user-provided Microsoft Excel documents, a specially crafted document can allow an attacker to read files from the local filesystem or from internal network resources via XML External Entity (XXE) Processing.

Weakness: CWE-611 (Improper Restriction of XML External Entity Reference)

## Which versions are affected by CVE-2019-12415?

2 open source packages ship an affected version, including org.apache.poi:poi. It affects 27 products.


| Package | Ecosystem | Affected | Fixed in |
| --- | --- | --- | --- |
| `org.apache.poi:poi` | Maven | All versions | 4.1.1 |
| `org.apache.poi:poi` | Maven | All versions | 4.1.1 |

Products: Apache Poi, Oracle Application Testing Suite, Oracle Banking Enterprise Originations, Oracle Banking Enterprise Product Manufacturing, Oracle Banking Payments, Oracle Banking Platform, Oracle Big Data Discovery, Oracle Communications Diameter Signaling Router Idih\, Oracle Endeca Information Discovery Studio, Oracle Enterprise Manager Base Platform, Oracle Enterprise Repository, Oracle Financial Services Analytical Applications Infrastructure, Oracle Financial Services Market Risk Measurement and Management, Oracle Flexcube Private Banking, Oracle Hyperion Infrastructure Technology, Oracle Instantis Enterprisetrack, Oracle Insurance Policy Administration J2ee, Oracle Insurance Rules Palette, Oracle Jdeveloper, Oracle Peoplesoft Enterprise Peopletools and 7 more.

## How do I fix CVE-2019-12415?

Upgrade org.apache.poi:poi to 4.1.1 or later.

## Is CVE-2019-12415 being exploited?

There is no known exploitation of CVE-2019-12415 in the wild and no public exploit code.

## Other vulnerabilities in Oracle Application Testing Suite

- [CVE-2017-12626](https://insights.sbomify.com/CVE-2017-12626/): Denial of Service in Apache POI (high 7.5)
- [CVE-2022-26336](https://insights.sbomify.com/CVE-2022-26336/): A carefully crafted TNEF file can cause an out of memory exception (medium 5.5)
- [CVE-2017-5644](https://insights.sbomify.com/CVE-2017-5644/): Improper Restriction of Recursive Entity References in DTDs in Apache POI (medium 5.5)
- [CVE-2016-5000](https://insights.sbomify.com/CVE-2016-5000/): Apache POI's XLSX2CSV Example XML External Entity (XXE) Vulnerability (medium 5.5)
- [CVE-2025-31672](https://insights.sbomify.com/CVE-2025-31672/): Apache POI OOXML Vulnerable to Improper Input Validation in OOXML File Parsing (medium 5.3)

## Fix prompt for AI coding agents

```text
Check this codebase for CVE-2019-12415 and fix it if it is affected.

What it is: CVE-2019-12415 is a medium-severity vulnerability in Oracle Application Testing Suite, published on 23 Oct 2019. It can only be exploited from the same machine or local network, with no action from the victim.
Exploitation: There is no known exploitation of CVE-2019-12415 in the wild and no public exploit code.

Affected packages and fixed versions:
- org.apache.poi:poi (Maven): affected all versions; fixed in 4.1.1
- org.apache.poi:poi (Maven): affected all versions; fixed in 4.1.1

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/CVE-2019-12415/ (Markdown: https://insights.sbomify.com/CVE-2019-12415/index.md)
```

## Sources

- CVE record: https://www.cve.org/CVERecord?id=CVE-2019-12415
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2019-12415
- OSV: https://osv.dev/vulnerability/CVE-2019-12415

---
From sbomify Insights: https://insights.sbomify.com/CVE-2019-12415/
Summaries are generated and may contain mistakes; the official description above is the record.