CVE-2019-12415

MEDIUM

5.5

Beschreibung

In Apache POI up to 4.1.0, when using the tool XSSFExportToXml to convert user-provided Microsoft Excel documents, a specially crafted document can allow an attacker to read files from the local filesystem or from internal network resources via XML External Entity (XXE) Processing.

CVE Details

CVSS v3.1 Bewertung5.5

SchweregradMEDIUM

CVSS VektorCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

AngriffsvektorLOCAL

KomplexitatLOW

Erforderliche PrivilegienLOW

BenutzerinteraktionNONE

Veroffentlicht10/23/2019

Zuletzt geandert11/21/2024

Quellenvd

Honeypot-Sichtungen0

Betroffene Produkte

apache:poioracle:application_testing_suiteoracle:banking_enterprise_originationsoracle:banking_enterprise_product_manufacturingoracle:banking_paymentsoracle:banking_platformoracle:big_data_discoveryoracle:communications_diameter_signaling_router_idih\oracle:endeca_information_discovery_studiooracle:enterprise_manager_base_platformoracle:enterprise_repositoryoracle:financial_services_analytical_applications_infrastructureoracle:financial_services_market_risk_measurement_and_managementoracle:flexcube_private_bankingoracle:hyperion_infrastructure_technologyoracle:instantis_enterprisetrackoracle:insurance_policy_administration_j2eeoracle:insurance_rules_paletteoracle:jdeveloperoracle:peoplesoft_enterprise_peopletoolsoracle:primavera_gatewayoracle:primavera_unifieroracle:retail_clearance_optimization_engineoracle:retail_order_brokeroracle:retail_predictive_application_serveroracle:webcenter_portaloracle:webcenter_sites

Schwachen (CWE)

CWE-611

Referenzen

https://lists.apache.org/thread.html/13a54b6a03369cfb418a699180ffb83bd727320b6ddfec198b9b728e%40%3Cannounce.apache.org%3E(security@apache.org)

https://lists.apache.org/thread.html/2ac0327748de0c2b3c1c012481b79936797c711724e0b7da83cf564c%40%3Cuser.tika.apache.org%3E(security@apache.org)

https://lists.apache.org/thread.html/895164e03a3c327449069e2fd6ced0367561878b3ae6a8ec740c2007%40%3Cuser.tika.apache.org%3E(security@apache.org)

https://lists.apache.org/thread.html/d88b8823867033514d7ec05d66f88c70dc207604d3dcbd44fd88464c%40%3Cuser.tika.apache.org%3E(security@apache.org)

https://lists.apache.org/thread.html/r204ba2a9ea750f38d789d2bb429cc0925ad6133deea7cbc3001d96b5%40%3Csolr-user.lucene.apache.org%3E(security@apache.org)

https://www.oracle.com//security-alerts/cpujul2021.html(security@apache.org)

https://www.oracle.com/security-alerts/cpuApr2021.html(security@apache.org)

https://www.oracle.com/security-alerts/cpuapr2020.html(security@apache.org)

https://www.oracle.com/security-alerts/cpujan2020.html(security@apache.org)

https://www.oracle.com/security-alerts/cpujan2021.html(security@apache.org)

https://www.oracle.com/security-alerts/cpujul2020.html(security@apache.org)

https://www.oracle.com/security-alerts/cpuoct2020.html(security@apache.org)

https://www.oracle.com/security-alerts/cpuoct2021.html(security@apache.org)

https://lists.apache.org/thread.html/13a54b6a03369cfb418a699180ffb83bd727320b6ddfec198b9b728e%40%3Cannounce.apache.org%3E(af854a3a-2127-422b-91ae-364da2661108)

https://lists.apache.org/thread.html/2ac0327748de0c2b3c1c012481b79936797c711724e0b7da83cf564c%40%3Cuser.tika.apache.org%3E(af854a3a-2127-422b-91ae-364da2661108)

https://lists.apache.org/thread.html/895164e03a3c327449069e2fd6ced0367561878b3ae6a8ec740c2007%40%3Cuser.tika.apache.org%3E(af854a3a-2127-422b-91ae-364da2661108)

https://lists.apache.org/thread.html/d88b8823867033514d7ec05d66f88c70dc207604d3dcbd44fd88464c%40%3Cuser.tika.apache.org%3E(af854a3a-2127-422b-91ae-364da2661108)

https://lists.apache.org/thread.html/r204ba2a9ea750f38d789d2bb429cc0925ad6133deea7cbc3001d96b5%40%3Csolr-user.lucene.apache.org%3E(af854a3a-2127-422b-91ae-364da2661108)

https://www.oracle.com//security-alerts/cpujul2021.html(af854a3a-2127-422b-91ae-364da2661108)

https://www.oracle.com/security-alerts/cpuApr2021.html(af854a3a-2127-422b-91ae-364da2661108)

https://www.oracle.com/security-alerts/cpuapr2020.html(af854a3a-2127-422b-91ae-364da2661108)

https://www.oracle.com/security-alerts/cpujan2020.html(af854a3a-2127-422b-91ae-364da2661108)

https://www.oracle.com/security-alerts/cpujan2021.html(af854a3a-2127-422b-91ae-364da2661108)

https://www.oracle.com/security-alerts/cpujul2020.html(af854a3a-2127-422b-91ae-364da2661108)

https://www.oracle.com/security-alerts/cpuoct2020.html(af854a3a-2127-422b-91ae-364da2661108)

https://www.oracle.com/security-alerts/cpuoct2021.html(af854a3a-2127-422b-91ae-364da2661108)

IOC Korrelationen

Keine Korrelationen erfasst

This product uses data from the NVD API but is not endorsed or certified by the NVD.