CVE-2014-3529
Improper Restriction of XML External Entity Reference in Apache POI
The OPC SAX setup in Apache POI before 3.10.1 allows remote attackers to read arbitrary files via an OpenXML file containing an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
Exploit likelihood
What each source reports
NVD Score used
The OPC SAX setup in Apache POI before 3.10.1 allows remote attackers to read arbitrary files via an OpenXML file containing an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
- Record
CVE-2014-3529- CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:P/I:N/A:N - Updated
- 2026-11-02
CVE List No score
The OPC SAX setup in Apache POI before 3.10.1 allows remote attackers to read arbitrary files via an OpenXML file containing an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
- Record
CVE-2014-3529- Updated
- 2026-11-02
EUVDEUVD-2022-4891 No score
The OPC SAX setup in Apache POI before 3.10.1 allows remote attackers to read arbitrary files via an OpenXML file containing an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
- Record
EUVD-2022-4891- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-q56h-jjj6-52mf No score
Improper Restriction of XML External Entity Reference in Apache POI
The OPC SAX setup in Apache POI before 3.10.1 allows remote attackers to read arbitrary files via an OpenXML file containing an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
- Record
GHSA-q56h-jjj6-52mf- Weakness
- CWE-611
- Updated
- 2026-11-02
OSVCLSA-2026-1777941834 No score
TuxCare security update for org.apache.poi (5 CVEs)
TuxCare rebuilt 3 org.apache.poi packages to address 5 CVEs. Fixed in 3.10-FINAL-tuxcare.1.
- Record
CLSA-2026-1777941834- Updated
- 2026-11-02
OSV No score
The OPC SAX setup in Apache POI before 3.10.1 allows remote attackers to read arbitrary files via an OpenXML file containing an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
- Record
CVE-2014-3529- Updated
- 2026-11-02
OSVDEBIAN-CVE-2014-3529 No score
The OPC SAX setup in Apache POI before 3.10.1 allows remote attackers to read arbitrary files via an OpenXML file containing an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
- Record
DEBIAN-CVE-2014-3529- Updated
- 2026-11-02
OSVGHSA-q56h-jjj6-52mf No score
Improper Restriction of XML External Entity Reference in Apache POI
The OPC SAX setup in Apache POI before 3.10.1 allows remote attackers to read arbitrary files via an OpenXML file containing an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
- Record
GHSA-q56h-jjj6-52mf- Weakness
- CWE-611
- Updated
- 2026-11-02
OSVMGASA-2014-0550 No score
Updated apache-poi packages fix security vulnerabilities
Updated apache-poi packages fix security vulnerabilities:
It was found that Apache POI would resolve entities in OOXML documents. A remote attacker able to supply OOXML documents that are parsed by Apache POI could use this flaw to read files accessible to the user running the application server, and potentially perform other more advanced XXE attacks (CVE-2014-3529).
It was found that Apache POI would expand an unlimited number of entities in OOXML documents. A remote attacker able to supply OOXML documents that are parsed by Apache POI could use this flaw to trigger a denial of service attack via excessive CPU and memory consumption (CVE-2014-3574).
- Record
MGASA-2014-0550- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.poi:poiMaven |
before 3.10.1 | 3.10.1 |
org.apache.poi:poiTuxCare:Maven |
3.10-FINAL up to 3.10-FINAL-tuxcare.1 | 3.10-FINAL-tuxcare.1 |
org.apache.poi:poi-ooxmlTuxCare:Maven |
3.10-FINAL up to 3.10-FINAL-tuxcare.1 | 3.10-FINAL-tuxcare.1 |
org.apache.poi:poi-scratchpadTuxCare:Maven |
3.10-FINAL up to 3.10-FINAL-tuxcare.1 | 3.10-FINAL-tuxcare.1 |
libapache-poi-javaDebian:12 |
before 3.10.1-1 | 3.10.1-1 |
libapache-poi-javaDebian:13 |
before 3.10.1-1 | 3.10.1-1 |
libapache-poi-javaDebian:14 |
before 3.10.1-1 | 3.10.1-1 |
org.apache.poi:poiMaven |
before 3.10.1, plus listed versions 3.0-FINAL3.0.1-FINAL3.0.2-FINAL3.0.2-beta13.0.2-beta2 Show 25 moreShow less3.1-FINAL3.1-beta13.1-beta23.10-FINAL3.10-beta13.10-beta23.2-FINAL3.5-FINAL3.5-beta13.5-beta33.5-beta43.5-beta53.5-beta63.63.73.7-beta13.7-beta23.7-beta33.83.8-beta13.8-beta23.8-beta33.8-beta43.8-beta53.9 |
3.10.1 |
apache-poiMageia:4 |
before 3.10.1-1.mga4 | 3.10.1-1.mga4 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| affected | OSV | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2014-3529 is a medium vulnerability (CVSS 4.3) in Apache Poi, published September 4, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 12.8%, the 96th percentile. Fixed in org.apache.poi:poi 3.10.1.
References
www-01.ibm.com/support/docview.wss?uid=swg21996759
poi.apache.org/changes.html
securityfocus.com/bid/78018
secunia.com/advisories/61766
lucene.apache.org/solr/solrnews.html
exchange.xforce.ibmcloud.com/vulnerabilities/95770
Show 20 moreShow less
rhn.redhat.com/errata/RHSA-2014-1370.html
apache.org/dist/poi/release/RELEASE-NOTES.txt
nvd.nist.gov/vuln/detail/CVE-2014-3529
github.com/apache/poi/commit/103b45073c7b504236588b3acc146530205af53c
security-tracker.debian.org/tracker/CVE-2014-3529
advisories.mageia.org/MGASA-2014-0550.html
bugs.mageia.org/show_bug.cgi?id=14128
lists.fedoraproject.org/pipermail/package-announce/2014-September/137802.html