Denial Of Service (DoS) Via XML External Expansion (XEE)

🗓️ 22 Mar 2017 01:45:07Reported by Veracode Vulnerability DatabaseType

veracode🔗 sca.analysiscenter.veracode.com👁 25 Views

Denial Of Service (DoS) vulnerability in poi-ooxml via XML Entity Expansion attac

Reporter	Title	Published	Views	Family All 37
IBM Security Bulletins	Security Bulletin: IBM DataQuant is affected by an Open Source Apache Poi vulnerability.	11 Feb 202116:57	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities found in poi-ooxml-3.9.jar which is shipped with IBM® Intelligent Operations Center(CVE-2017-5644, CVE-2019-12415, CVE-2014-3574, CVE-2014-3529)	5 Sep 202312:52	–	ibm
IBM Security Bulletins	Security Bulletin: Atlas eDiscovery Process Management is affected by a vulnerable poi-ooxml-3.9.jar	8 May 202308:37	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Security Vulnerabilities Impact IBM Predictive Insights	8 Sep 202020:36	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in Apache POI affects IBM Emptoris Services Procurement (CVE-2017-5644)	16 Jun 201820:12	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM Jazz Team Server affect IBM Rational products based on IBM Jazz technology	28 Apr 202118:35	–	ibm
IBM Security Bulletins	Security Bulletin: IBM OpenPages GRC Platform has addressed multiple Apache POI vulnerabilities (CVE-2017-5644, CVE-2016-5000, CVE-2014-3574)	15 Jun 201822:48	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Tivoli Common Reporting (TCR) 2017Q3 Security Updater: TCR, a part of IBM Jazz for Service Management (JazzSM) is affected by multiple vulnerabilities	17 Jun 201815:47	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities affect embedded rules in IBM Business Automation Workflow	11 Jan 202413:32	–	ibm
IBM Security Bulletins	Security Bulletin: Apache POI as used in IBM QRadar SIEM is vulnerable to a denial of service. (CVE-2017-5644)	16 Jun 201822:04	–	ibm

Vulners

Node

apache poiRange≤3.14

Source	Link
github	www.github.com/apache/poi/commit/3a328aa220f6979f9805f658ae33244d153beaa7
seclists	www.seclists.org/oss-sec/2017/q1/654
www-us	www.www-us.apache.org/dist/poi/dev/RELEASE-NOTES.txt
securityfocus	www.securityfocus.com/bid/96983
poi	www.poi.apache.org/
oracle	www.oracle.com/security-alerts/cpuoct2020.html

21 Jan 2021 07:25Current

5.5Medium risk

Vulners AI Score5.5

CVSS 35.5

CVSS 27.1

EPSS0.04595