CVE-2019-12415

5.5 mediumEPSS 1.0%

In Apache POI up to 4.1.0, when using the tool XSSFExportToXml to convert user-provided Microsoft Excel documents, a specially crafted document can allow an attacker to read files from the local filesystem or from internal network resources via XML External Entity (XXE) Processing.

Severity

CVSS 3.1

5.5 medium

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

EPSS: 1.0% chance of exploitation in the next 30 days; higher than 62% of CVEs (scores of 2026-10-31)
CWE: CWE-611
Published: 2019-10-23
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

apache:poi
oracle:application_testing_suite
oracle:banking_enterprise_originations
oracle:banking_enterprise_product_manufacturing
oracle:banking_payments
oracle:banking_platform
oracle:big_data_discovery
oracle:communications_diameter_signaling_router_idih\
oracle:endeca_information_discovery_studio
oracle:enterprise_manager_base_platform
oracle:enterprise_repository
oracle:financial_services_analytical_applications_infrastructure
oracle:financial_services_market_risk_measurement_and_management
oracle:flexcube_private_banking
oracle:hyperion_infrastructure_technology
oracle:instantis_enterprisetrack
oracle:insurance_policy_administration_j2ee
oracle:insurance_rules_palette
oracle:jdeveloper
oracle:peoplesoft_enterprise_peopletools
oracle:primavera_gateway
oracle:primavera_unifier
oracle:retail_clearance_optimization_engine
oracle:retail_order_broker
oracle:retail_predictive_application_server
oracle:webcenter_portal
oracle:webcenter_sites

Packages (OSV)

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-9jwc-q6j3-8g9g	Maven	org.apache.poi:poi	<4.1.1	4.1.1

References

Check your stack JSON