What’s Vulnerable › Vulnerabilities
CVE-2019-12415
- Severity: medium (CVSS 5.5 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 1.0% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2019-10-23 · updated 2026-06-17
- Weakness: CWE-611
Description
In Apache POI up to 4.1.0, when using the tool XSSFExportToXml to convert user-provided Microsoft Excel documents, a specially crafted document can allow an attacker to read files from the local filesystem or from internal network resources via XML External Entity (XXE) Processing.
Affected products
- Apache Software Foundation Apache POI: through 4.1.0
- Oracle Corporation Oracle Application Testing Suite: 12.5.0.3, 13.1.0.1, 13.2.0.1, 13.3.0.1
- Oracle Banking Enterprise Originations: 2.7.0, 2.8.0
- Oracle Banking Enterprise Product Manufacturing: 2.7.0, 2.8.0
- Oracle Corporation Banking Payments: 14.0.0, 14.1.0
- Oracle Banking Platform: 2.4.0, 2.4.1, 2.5.0, 2.6.0, 2.6.1, 2.6.2 (+3)
- Oracle Big Data Discovery: 1.6
- Oracle Communications Diameter Signaling Router Idih:: 8.0.0, 8.2.2
- Oracle Endeca Information Discovery Studio: 3.2.0
- Oracle Corporation Enterprise Manager Base Platform: 12.1.0.5, 13.3.0.0, 13.4.0.0
- Oracle Corporation Enterprise Repository: 12.1.3.0.0
- Oracle Corporation Financial Services Analytical Applications Infrastructure: from 8.0.6 through 8.0.9
- Oracle Corporation Financial Services Market Risk Measurement and Management: 8.0.6, 8.0.8
- Oracle Corporation FLEXCUBE Private Banking: 12.0.0, 12.1.0
- Oracle Corporation Oracle Hyperion Infrastructure Technology: 11.1.2.4
- Oracle Instantis Enterprisetrack: 17.1, 17.2, 17.3
- Oracle Insurance Policy Administration J2Ee: 11.0.2, 11.1.0, 11.2.0
- Oracle Insurance Rules Palette: 10.2.0, 10.2.4, 11.0.2, 11.1.0, 11.2.0
- Oracle Corporation Oracle JDeveloper: 12.2.1.4.0
- Oracle Corporation PeopleSoft Enterprise PT PeopleTools: 8.57, 8.58, 8.59
- Oracle Corporation Primavera Gateway: 17.12.6, 18.8.8.1
- Oracle Corporation Primavera Unifier: from 17.7 through 17.12; 16.1, 16.2, 18.8, 19.12
- Oracle Retail Clearance Optimization Engine: 14.0
- Oracle Retail Order Broker: 15.0, 16.0
- Oracle Retail Predictive Application Server: 15.0.3, 16.0.3
- Oracle Corporation Oracle WebCenter Portal: 12.2.1.3.0, 12.2.1.4.0
- Oracle Corporation Oracle WebCenter Sites: 12.2.1.3.0, 12.2.1.4.0
References
- https://lists.apache.org/thread.html/13a54b6a03369cfb418a699180ffb83bd727320b6ddfec198b9b728e%40%3Cannounce.apache.org%3E
- https://lists.apache.org/thread.html/2ac0327748de0c2b3c1c012481b79936797c711724e0b7da83cf564c%40%3Cuser.tika.apache.org%3E
- https://lists.apache.org/thread.html/895164e03a3c327449069e2fd6ced0367561878b3ae6a8ec740c2007%40%3Cuser.tika.apache.org%3E
- https://lists.apache.org/thread.html/d88b8823867033514d7ec05d66f88c70dc207604d3dcbd44fd88464c%40%3Cuser.tika.apache.org%3E
- https://lists.apache.org/thread.html/r204ba2a9ea750f38d789d2bb429cc0925ad6133deea7cbc3001d96b5%40%3Csolr-user.lucene.apache.org%3E
- https://www.oracle.com//security-alerts/cpujul2021.html
- https://www.oracle.com/security-alerts/cpuApr2021.html
- https://www.oracle.com/security-alerts/cpuapr2020.html
- https://www.oracle.com/security-alerts/cpujan2020.html
- https://www.oracle.com/security-alerts/cpujan2021.html
- https://www.oracle.com/security-alerts/cpujul2020.html
- https://www.oracle.com/security-alerts/cpuoct2020.html
Get alerted when CVE-2019-12415 or the next vulnerability affects your stack