Improper Restriction of XML External Entity Reference in Apache POI
Date: 2022-05
Affected: maven/org.apache.poi:poi
Attack vector: other
Category: vulnerability-disclosure
Severity: Medium
CVE: CVE-2014-3529
CVE-2014-3574
CVE-2019-12415
CWE: CWE-20
CWE-611
CVSS: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)

In Apache POI up to 4.1.0, when using the tool XSSFExportToXml to convert user-provided Microsoft Excel documents, a specially crafted document can allow an attacker to read files from the local filesystem or from internal network resources via XML External Entity (XXE) Processing.


Mitigations:

Architectural layers (MAESTRO):