Security Bulletin: Apache POI up to 4.1.0 allows an attacker while converting user-provided document to XML

Summary

In Apache POI up to 4.1.0, when using the tool XSSFExportToXml to convert user-provided Microsoft Excel documents, a specially crafted document can allow an attacker​​.

Vulnerability Details

CVEID:CVE-2019-12415
**DESCRIPTION:**Apache POI could allow a remote attacker to obtain sensitive information, caused by an XML external entity (XXE) error when processing XML data by tool XSSFExportToXml. By sending a specially-crafted document, a remote attacker could exploit this vulnerability to obtain sensitive information.
CVSS Base score: 5.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/170015 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)

Affected Products and Versions

Remediation/Fixes

Existing Apache POI version was 3.17 and it was vulnerable in the system. So, it has been upgraded to 4.1.2 and vulnerabilities have been mitigated.

Workarounds and Mitigations

Apache POI version upgraded to 4.1.2 from 3.17 to mitigate vulnerabilities.