CVEDB API

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2019-12415

In Apache POI up to 4.1.0, when using the tool XSSFExportToXml to convert user-provided Microsoft Excel documents, a specially crafted document can allow an attacker to read files from the local filesystem or from internal network resources via XML External Entity (XXE) Processing.

Exploit prediction scoring system (EPSS) score

EPSS Score 0.0

EPSS Ranking 4.5%

CVSS Severity

CVSS v3 Score 5.5

CVSS v2 Score 2.1

References

Products affected by CVE-2019-12415

Apache » Poi » Version: 0.1

cpe:2.3:a:apache:poi:0.1
Apache » Poi » Version: 0.10.0

cpe:2.3:a:apache:poi:0.10.0
Apache » Poi » Version: 0.11.0

cpe:2.3:a:apache:poi:0.11.0
Apache » Poi » Version: 0.12.0

cpe:2.3:a:apache:poi:0.12.0
Apache » Poi » Version: 0.13.0

cpe:2.3:a:apache:poi:0.13.0
Apache » Poi » Version: 0.14.0

cpe:2.3:a:apache:poi:0.14.0
Apache » Poi » Version: 0.2

cpe:2.3:a:apache:poi:0.2
Apache » Poi » Version: 0.3

cpe:2.3:a:apache:poi:0.3
Apache » Poi » Version: 0.4

cpe:2.3:a:apache:poi:0.4
Apache » Poi » Version: 0.5

cpe:2.3:a:apache:poi:0.5
Apache » Poi » Version: 0.6

cpe:2.3:a:apache:poi:0.6
Apache » Poi » Version: 0.7

cpe:2.3:a:apache:poi:0.7
Apache » Poi » Version: 1.0.0

cpe:2.3:a:apache:poi:1.0.0
Apache » Poi » Version: 1.0.1

cpe:2.3:a:apache:poi:1.0.1
Apache » Poi » Version: 1.0.2

cpe:2.3:a:apache:poi:1.0.2
Apache » Poi » Version: 1.1.0

cpe:2.3:a:apache:poi:1.1.0
Apache » Poi » Version: 1.10

cpe:2.3:a:apache:poi:1.10
Apache » Poi » Version: 1.2.0

cpe:2.3:a:apache:poi:1.2.0
Apache » Poi » Version: 1.5

cpe:2.3:a:apache:poi:1.5
Apache » Poi » Version: 1.5.1

cpe:2.3:a:apache:poi:1.5.1
Apache » Poi » Version: 1.7

cpe:2.3:a:apache:poi:1.7
Apache » Poi » Version: 1.8

cpe:2.3:a:apache:poi:1.8
Apache » Poi » Version: 2.0

cpe:2.3:a:apache:poi:2.0
Apache » Poi » Version: 2.5

cpe:2.3:a:apache:poi:2.5
Apache » Poi » Version: 2.5.1

cpe:2.3:a:apache:poi:2.5.1
Apache » Poi » Version: 3.0

cpe:2.3:a:apache:poi:3.0
Apache » Poi » Version: 3.0.1

cpe:2.3:a:apache:poi:3.0.1
Apache » Poi » Version: 3.0.2

cpe:2.3:a:apache:poi:3.0.2
Apache » Poi » Version: 3.1

cpe:2.3:a:apache:poi:3.1
Apache » Poi » Version: 3.10

cpe:2.3:a:apache:poi:3.10
Apache » Poi » Version: 3.11

cpe:2.3:a:apache:poi:3.11
Apache » Poi » Version: 3.13

cpe:2.3:a:apache:poi:3.13
Apache » Poi » Version: 3.14

cpe:2.3:a:apache:poi:3.14
Apache » Poi » Version: 3.17

cpe:2.3:a:apache:poi:3.17
Apache » Poi » Version: 3.2

cpe:2.3:a:apache:poi:3.2
Apache » Poi » Version: 3.5

cpe:2.3:a:apache:poi:3.5
Apache » Poi » Version: 3.6

cpe:2.3:a:apache:poi:3.6
Apache » Poi » Version: 3.7

cpe:2.3:a:apache:poi:3.7
Apache » Poi » Version: 3.8

cpe:2.3:a:apache:poi:3.8
Apache » Poi » Version: 3.9

cpe:2.3:a:apache:poi:3.9
Apache » Poi » Version: 4.1.0

cpe:2.3:a:apache:poi:4.1.0
Oracle » Application Testing Suite » Version: 12.5.0.3

cpe:2.3:a:oracle:application_testing_suite:12.5.0.3
Oracle » Application Testing Suite » Version: 13.1.0.1

cpe:2.3:a:oracle:application_testing_suite:13.1.0.1
Oracle » Application Testing Suite » Version: 13.2.0.1

cpe:2.3:a:oracle:application_testing_suite:13.2.0.1
Oracle » Application Testing Suite » Version: 13.3.0.1

cpe:2.3:a:oracle:application_testing_suite:13.3.0.1
Oracle » Banking Enterprise Originations » Version: 2.7.0

cpe:2.3:a:oracle:banking_enterprise_originations:2.7.0
Oracle » Banking Enterprise Originations » Version: 2.8.0

cpe:2.3:a:oracle:banking_enterprise_originations:2.8.0
Oracle » Banking Enterprise Product Manufacturing » Version: 2.7.0

cpe:2.3:a:oracle:banking_enterprise_product_manufacturing:2.7.0
Oracle » Banking Enterprise Product Manufacturing » Version: 2.8.0

cpe:2.3:a:oracle:banking_enterprise_product_manufacturing:2.8.0
Oracle » Banking Payments » Version: 14.0.0

cpe:2.3:a:oracle:banking_payments:14.0.0
Oracle » Banking Payments » Version: 14.1.0

cpe:2.3:a:oracle:banking_payments:14.1.0
Oracle » Banking Platform » Version: 2.4.0

cpe:2.3:a:oracle:banking_platform:2.4.0
Oracle » Banking Platform » Version: 2.4.1

cpe:2.3:a:oracle:banking_platform:2.4.1
Oracle » Banking Platform » Version: 2.5.0

cpe:2.3:a:oracle:banking_platform:2.5.0
Oracle » Banking Platform » Version: 2.6.0

cpe:2.3:a:oracle:banking_platform:2.6.0
Oracle » Banking Platform » Version: 2.6.1

cpe:2.3:a:oracle:banking_platform:2.6.1
Oracle » Banking Platform » Version: 2.6.2

cpe:2.3:a:oracle:banking_platform:2.6.2
Oracle » Banking Platform » Version: 2.7.0

cpe:2.3:a:oracle:banking_platform:2.7.0
Oracle » Banking Platform » Version: 2.7.1

cpe:2.3:a:oracle:banking_platform:2.7.1
Oracle » Banking Platform » Version: 2.9.0

cpe:2.3:a:oracle:banking_platform:2.9.0
Oracle » Big Data Discovery » Version: 1.6

cpe:2.3:a:oracle:big_data_discovery:1.6
Oracle » Communications Diameter Signaling Router Idih: » Version: Any

cpe:2.3:a:oracle:communications_diameter_signaling_router_idih:
Oracle » Endeca Information Discovery Studio » Version: 3.2.0

cpe:2.3:a:oracle:endeca_information_discovery_studio:3.2.0
Oracle » Enterprise Manager Base Platform » Version: 12.1.0.5

cpe:2.3:a:oracle:enterprise_manager_base_platform:12.1.0.5
Oracle » Enterprise Manager Base Platform » Version: 13.3.0.0

cpe:2.3:a:oracle:enterprise_manager_base_platform:13.3.0.0
Oracle » Enterprise Manager Base Platform » Version: 13.4.0.0

cpe:2.3:a:oracle:enterprise_manager_base_platform:13.4.0.0
Oracle » Enterprise Repository » Version: 12.1.3.0.0

cpe:2.3:a:oracle:enterprise_repository:12.1.3.0.0
Oracle » Financial Services Analytical Applications Infrastructure » Version: 8.0.6

cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:8.0.6
Oracle » Financial Services Analytical Applications Infrastructure » Version: 8.0.6.0.0

cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:8.0.6.0.0
Oracle » Financial Services Analytical Applications Infrastructure » Version: 8.0.6.0.1

cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:8.0.6.0.1
Oracle » Financial Services Analytical Applications Infrastructure » Version: 8.0.6.1.0

cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:8.0.6.1.0
Oracle » Financial Services Analytical Applications Infrastructure » Version: 8.0.6.2.0

cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:8.0.6.2.0
Oracle » Financial Services Analytical Applications Infrastructure » Version: 8.0.6.3.0

cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:8.0.6.3.0
Oracle » Financial Services Analytical Applications Infrastructure » Version: 8.0.6.4.0

cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:8.0.6.4.0
Oracle » Financial Services Analytical Applications Infrastructure » Version: 8.0.7

cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:8.0.7
Oracle » Financial Services Analytical Applications Infrastructure » Version: 8.0.7.0.0

cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:8.0.7.0.0
Oracle » Financial Services Analytical Applications Infrastructure » Version: 8.0.7.1.0

cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:8.0.7.1.0
Oracle » Financial Services Analytical Applications Infrastructure » Version: 8.0.7.2.0

cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:8.0.7.2.0
Oracle » Financial Services Analytical Applications Infrastructure » Version: 8.0.8

cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:8.0.8
Oracle » Financial Services Analytical Applications Infrastructure » Version: 8.0.8.0.0

cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:8.0.8.0.0
Oracle » Financial Services Analytical Applications Infrastructure » Version: 8.0.9

cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:8.0.9
Oracle » Financial Services Market Risk Measurement And Management » Version: 8.0.6

cpe:2.3:a:oracle:financial_services_market_risk_measurement_and_management:8.0.6
Oracle » Financial Services Market Risk Measurement And Management » Version: 8.0.8

cpe:2.3:a:oracle:financial_services_market_risk_measurement_and_management:8.0.8
Oracle » Flexcube Private Banking » Version: 12.0.0

cpe:2.3:a:oracle:flexcube_private_banking:12.0.0
Oracle » Flexcube Private Banking » Version: 12.1.0

cpe:2.3:a:oracle:flexcube_private_banking:12.1.0
Oracle » Hyperion Infrastructure Technology » Version: 11.1.2.4

cpe:2.3:a:oracle:hyperion_infrastructure_technology:11.1.2.4
Oracle » Instantis Enterprisetrack » Version: 17.1

cpe:2.3:a:oracle:instantis_enterprisetrack:17.1
Oracle » Instantis Enterprisetrack » Version: 17.2

cpe:2.3:a:oracle:instantis_enterprisetrack:17.2
Oracle » Instantis Enterprisetrack » Version: 17.3

cpe:2.3:a:oracle:instantis_enterprisetrack:17.3
Oracle » Insurance Policy Administration J2ee » Version: 11.0.2

cpe:2.3:a:oracle:insurance_policy_administration_j2ee:11.0.2
Oracle » Insurance Policy Administration J2ee » Version: 11.1.0

cpe:2.3:a:oracle:insurance_policy_administration_j2ee:11.1.0
Oracle » Insurance Policy Administration J2ee » Version: 11.2.0

cpe:2.3:a:oracle:insurance_policy_administration_j2ee:11.2.0
Oracle » Insurance Rules Palette » Version: 10.2.0

cpe:2.3:a:oracle:insurance_rules_palette:10.2.0
Oracle » Insurance Rules Palette » Version: 10.2.4

cpe:2.3:a:oracle:insurance_rules_palette:10.2.4
Oracle » Insurance Rules Palette » Version: 11.0.2

cpe:2.3:a:oracle:insurance_rules_palette:11.0.2
Oracle » Insurance Rules Palette » Version: 11.1.0

cpe:2.3:a:oracle:insurance_rules_palette:11.1.0
Oracle » Insurance Rules Palette » Version: 11.2.0

cpe:2.3:a:oracle:insurance_rules_palette:11.2.0
Oracle » Jdeveloper » Version: 12.2.1.4.0

cpe:2.3:a:oracle:jdeveloper:12.2.1.4.0
Oracle » Peoplesoft Enterprise Peopletools » Version: 8.57

cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.57
Oracle » Peoplesoft Enterprise Peopletools » Version: 8.58

cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58
Oracle » Peoplesoft Enterprise Peopletools » Version: 8.59

cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.59
Oracle » Primavera Gateway » Version: 17.12.6

cpe:2.3:a:oracle:primavera_gateway:17.12.6
Oracle » Primavera Gateway » Version: 18.8.8.1

cpe:2.3:a:oracle:primavera_gateway:18.8.8.1
Oracle » Primavera Unifier » Version: 16.1

cpe:2.3:a:oracle:primavera_unifier:16.1
Oracle » Primavera Unifier » Version: 16.2

cpe:2.3:a:oracle:primavera_unifier:16.2
Oracle » Primavera Unifier » Version: 17.10

cpe:2.3:a:oracle:primavera_unifier:17.10
Oracle » Primavera Unifier » Version: 17.11

cpe:2.3:a:oracle:primavera_unifier:17.11
Oracle » Primavera Unifier » Version: 17.12

cpe:2.3:a:oracle:primavera_unifier:17.12
Oracle » Primavera Unifier » Version: 17.7

cpe:2.3:a:oracle:primavera_unifier:17.7
Oracle » Primavera Unifier » Version: 17.8

cpe:2.3:a:oracle:primavera_unifier:17.8
Oracle » Primavera Unifier » Version: 17.9

cpe:2.3:a:oracle:primavera_unifier:17.9
Oracle » Primavera Unifier » Version: 18.8

cpe:2.3:a:oracle:primavera_unifier:18.8
Oracle » Primavera Unifier » Version: 19.12

cpe:2.3:a:oracle:primavera_unifier:19.12
Oracle » Retail Clearance Optimization Engine » Version: 14.0

cpe:2.3:a:oracle:retail_clearance_optimization_engine:14.0
Oracle » Retail Order Broker » Version: 15.0

cpe:2.3:a:oracle:retail_order_broker:15.0
Oracle » Retail Order Broker » Version: 16.0

cpe:2.3:a:oracle:retail_order_broker:16.0
Oracle » Retail Predictive Application Server » Version: 15.0.3

cpe:2.3:a:oracle:retail_predictive_application_server:15.0.3
Oracle » Retail Predictive Application Server » Version: 16.0.3

cpe:2.3:a:oracle:retail_predictive_application_server:16.0.3
Oracle » Webcenter Portal » Version: 12.2.1.3.0

cpe:2.3:a:oracle:webcenter_portal:12.2.1.3.0
Oracle » Webcenter Portal » Version: 12.2.1.4.0

cpe:2.3:a:oracle:webcenter_portal:12.2.1.4.0
Oracle » Webcenter Sites » Version: 12.2.1.3.0

cpe:2.3:a:oracle:webcenter_sites:12.2.1.3.0
Oracle » Webcenter Sites » Version: 12.2.1.4.0

cpe:2.3:a:oracle:webcenter_sites:12.2.1.4.0

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2019-12415

Products

Pricing

Contact Us