CVE-2019-12415
Improper Restriction of XML External Entity Reference in Apache POI
In Apache POI up to 4.1.0, when using the tool XSSFExportToXml to convert user-provided Microsoft Excel documents, a specially crafted document can allow an attacker to read files from the local filesystem or from internal network resources via XML External Entity (XXE) Processing.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
In Apache POI up to 4.1.0, when using the tool XSSFExportToXml to convert user-provided Microsoft Excel documents, a specially crafted document can allow an attacker to read files from the local filesystem or from internal network resources via XML External Entity (XXE) Processing.
- Record
CVE-2019-12415- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - CVSS 2.0
- 2.1 Low
AV:L/AC:L/Au:N/C:P/I:N/A:N - Weakness
- CWE-611
- Updated
- 2026-11-02
CVE List No score
In Apache POI up to 4.1.0, when using the tool XSSFExportToXml to convert user-provided Microsoft Excel documents, a specially crafted document can allow an attacker to read files from the local filesystem or from internal network resources via XML External Entity (XXE) Processing.
- Record
CVE-2019-12415- Updated
- 2026-11-02
EUVDEUVD-2022-3406 No score
In Apache POI up to 4.1.0, when using the tool XSSFExportToXml to convert user-provided Microsoft Excel documents, a specially crafted document can allow an attacker to read files from the local filesystem or from internal network resources via XML External Entity (XXE) Processing.
- Record
EUVD-2022-3406- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-9jwc-q6j3-8g9g
Improper Restriction of XML External Entity Reference in Apache POI
In Apache POI up to 4.1.0, when using the tool XSSFExportToXml to convert user-provided Microsoft Excel documents, a specially crafted document can allow an attacker to read files from the local filesystem or from internal network resources via XML External Entity (XXE) Processing.
- Record
GHSA-9jwc-q6j3-8g9g- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-611
- Updated
- 2026-11-02
OSV
In Apache POI up to 4.1.0, when using the tool XSSFExportToXml to convert user-provided Microsoft Excel documents, a specially crafted document can allow an attacker to read files from the local filesystem or from internal network resources via XML External Entity (XXE) Processing.
- Record
CVE-2019-12415- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2019-12415
In Apache POI up to 4.1.0, when using the tool XSSFExportToXml to convert user-provided Microsoft Excel documents, a specially crafted document can allow an attacker to read files from the local filesystem or from internal network resources via XML External Entity (XXE) Processing.
- Record
DEBIAN-CVE-2019-12415- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVGHSA-9jwc-q6j3-8g9g
Improper Restriction of XML External Entity Reference in Apache POI
In Apache POI up to 4.1.0, when using the tool XSSFExportToXml to convert user-provided Microsoft Excel documents, a specially crafted document can allow an attacker to read files from the local filesystem or from internal network resources via XML External Entity (XXE) Processing.
- Record
GHSA-9jwc-q6j3-8g9g- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-611
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2019-12415
In Apache POI up to 4.1.0, when using the tool XSSFExportToXml to convert user-provided Microsoft Excel documents, a specially crafted document can allow an attacker to read files from the local filesystem or from internal network resources via XML External Entity (XXE) Processing.
- Record
UBUNTU-CVE-2019-12415- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
Affected products
- apache poi
- apache software foundation poi
- oracle application testing suite
- oracle banking enterprise originations
- oracle banking enterprise product manufacturing
- oracle banking payments
- oracle banking platform
- oracle big data discovery
- oracle communications diameter signaling router idih\
- oracle endeca information discovery studio
- oracle enterprise manager base platform
- oracle enterprise repository
Show 16 moreShow less
- oracle financial services analytical applications infrastructure
- oracle financial services market risk measurement and management
- oracle flexcube private banking
- oracle hyperion infrastructure technology
- oracle instantis enterprisetrack
- oracle insurance policy administration j2ee
- oracle insurance rules palette
- oracle jdeveloper
- oracle peoplesoft enterprise peopletools
- oracle primavera gateway
- oracle primavera unifier
- oracle retail clearance optimization engine
- oracle retail order broker
- oracle retail predictive application server
- oracle webcenter portal
- oracle webcenter sites
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.poi:poiMaven |
through 4.1.0 | 4.1.1 |
libapache-poi-javaDebian:12 |
All versions, plus listed versions 4.0.1-44.0.1-54.0.1-64.1.1-1 |
None known |
libapache-poi-javaDebian:13 |
All versions, plus listed versions 4.0.1-64.1.1-1 |
None known |
libapache-poi-javaDebian:14 |
before 4.1.1-1, plus listed versions 4.0.1-6 |
4.1.1-1 |
org.apache.poi:poiMaven |
before 4.1.1, plus listed versions 3.0-FINAL3.0.1-FINAL3.0.2-FINAL3.0.2-beta13.0.2-beta2 Show 45 moreShow less3.1-FINAL3.1-beta13.1-beta23.10-FINAL3.10-beta13.10-beta23.10.13.113.11-beta13.11-beta23.11-beta33.123.12-beta13.133.13-beta13.143.14-beta13.153.15-beta13.15-beta23.163.16-beta13.16-beta23.173.17-beta13.2-FINAL3.5-FINAL3.5-beta13.5-beta33.5-beta43.5-beta53.5-beta63.63.73.7-beta13.7-beta23.7-beta33.83.8-beta13.8-beta23.8-beta33.8-beta43.8-beta53.94.0.0 |
4.1.1 |
libapache-poi-javaUbuntu:16.04:LTS |
All versions, plus listed versions 3.10.1-2 |
None known |
libapache-poi-javaUbuntu:18.04:LTS |
All versions, plus listed versions 3.10.1-34.0.1-1~18.03 |
None known |
libapache-poi-javaUbuntu:20.04:LTS |
All versions, plus listed versions 4.0.1-1 |
None known |
libapache-poi-javaUbuntu:22.04:LTS |
All versions, plus listed versions 4.0.1-14.0.1-24.0.1-3 |
None known |
libapache-poi-javaUbuntu:24.04:LTS |
All versions, plus listed versions 4.0.1-44.0.1-54.0.1-6 |
None known |
libapache-poi-javaUbuntu:25.10 |
All versions, plus listed versions 4.0.1-6 |
None known |
libapache-poi-javaUbuntu:26.10 |
All versions, plus listed versions 4.0.1-6 |
None known |
libapache-poi-javaUbuntu:26.04:LTS |
All versions, plus listed versions 4.0.1-6 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, products | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2019-12415 is a medium vulnerability (CVSS 5.5) in Apache Poi, published October 23, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.00%, the 62nd percentile. Fixed in org.apache.poi:poi 4.1.1.
References
lists.apache.org/thread.html/2ac0327748de0c2b3c1c012481b79936797c711724e0b7da83cf564c%40%3Cuser.tika.apache.org%3E
oracle.com/security-alerts/cpuapr2020.html
Show 19 moreShow less
nvd.nist.gov/vuln/detail/CVE-2019-12415
github.com/advisories/GHSA-9jwc-q6j3-8g9g
security-tracker.debian.org/tracker/CVE-2019-12415
ubuntu.com/security/CVE-2019-12415
openwall.com/lists/oss-security/2019/10/23/1
cve.org/CVERecord?id=CVE-2019-12415
Left out here: 2 versions. The JSON record has them.