Medium severity5.5OSV Advisory· Published Oct 23, 2019· Updated Jun 17, 2026

CVE-2019-12415

Description

In Apache POI up to 4.1.0, when using the tool XSSFExportToXml to convert user-provided Microsoft Excel documents, a specially crafted document can allow an attacker to read files from the local filesystem or from internal network resources via XML External Entity (XXE) Processing.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
org.apache.poi:poiMaven	< 4.1.1	4.1.1

Affected products

Apache/PoiOSV2 versions
REL_4_1_0+ 1 more
- (no CPE)range: REL_4_1_0
- cpe:2.3:a:apache:poi:*:*:*:*:*:*:*:*range: <=4.1.0
Oracle Corporation/Application Testing Suite4 versions
cpe:2.3:a:oracle:application_testing_suite:12.5.0.3:*:*:*:*:*:*:*+ 3 more
- cpe:2.3:a:oracle:application_testing_suite:12.5.0.3:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:application_testing_suite:13.1.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:application_testing_suite:13.2.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:application_testing_suite:13.3.0.1:*:*:*:*:*:*:*
Oracle Corporation/Banking Enterprise Originations2 versions
cpe:2.3:a:oracle:banking_enterprise_originations:2.7.0:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:oracle:banking_enterprise_originations:2.7.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:banking_enterprise_originations:2.8.0:*:*:*:*:*:*:*
Oracle Corporation/Banking Enterprise Product Manufacturing2 versions
cpe:2.3:a:oracle:banking_enterprise_product_manufacturing:2.7.0:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:oracle:banking_enterprise_product_manufacturing:2.7.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:banking_enterprise_product_manufacturing:2.8.0:*:*:*:*:*:*:*
Oracle Corporation/Banking Payments2 versions
cpe:2.3:a:oracle:banking_payments:14.0.0:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:oracle:banking_payments:14.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:banking_payments:14.1.0:*:*:*:*:*:*:*
Oracle Corporation/Banking Platform9 versions
cpe:2.3:a:oracle:banking_platform:2.4.0:*:*:*:*:*:*:*+ 8 more
- cpe:2.3:a:oracle:banking_platform:2.4.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:banking_platform:2.4.1:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:banking_platform:2.5.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:banking_platform:2.6.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:banking_platform:2.6.1:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:banking_platform:2.6.2:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:banking_platform:2.7.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:banking_platform:2.7.1:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:banking_platform:2.9.0:*:*:*:*:*:*:*
Oracle Corporation/Big Data Discovery
cpe:2.3:a:oracle:big_data_discovery:1.6:*:*:*:*:*:*:*
Oracle Corporation/Communications Diameter Signaling Router Idih\2 versions
cpe:2.3:a:oracle:communications_diameter_signaling_router_idih\::8.0.0:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:oracle:communications_diameter_signaling_router_idih\::8.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:communications_diameter_signaling_router_idih\::8.2.2:*:*:*:*:*:*:*
Oracle Corporation/Endeca Information Discovery Studio
cpe:2.3:a:oracle:endeca_information_discovery_studio:3.2.0:*:*:*:*:*:*:*
Oracle Corporation/Enterprise Manager Base Platform3 versions
cpe:2.3:a:oracle:enterprise_manager_base_platform:12.1.0.5:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:a:oracle:enterprise_manager_base_platform:12.1.0.5:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:enterprise_manager_base_platform:13.3.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:enterprise_manager_base_platform:13.4.0.0:*:*:*:*:*:*:*
Oracle Corporation/Enterprise Repository
cpe:2.3:a:oracle:enterprise_repository:12.1.3.0.0:*:*:*:*:*:*:*
Oracle Corporation/Financial Services Analytical Applications Infrastructure
cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:*:*:*:*:*:*:*:*
Range: >=8.0.6,<=8.0.9
Oracle Corporation/Financial Services Market Risk Measurement And Management2 versions
cpe:2.3:a:oracle:financial_services_market_risk_measurement_and_management:8.0.6:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:oracle:financial_services_market_risk_measurement_and_management:8.0.6:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:financial_services_market_risk_measurement_and_management:8.0.8:*:*:*:*:*:*:*
Oracle Corporation/Flexcube Private Banking2 versions
cpe:2.3:a:oracle:flexcube_private_banking:12.0.0:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:oracle:flexcube_private_banking:12.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:flexcube_private_banking:12.1.0:*:*:*:*:*:*:*
Oracle Corporation/Hyperion Infrastructure Technology
cpe:2.3:a:oracle:hyperion_infrastructure_technology:11.1.2.4:*:*:*:*:*:*:*
Oracle Corporation/Instantis Enterprisetrack3 versions
cpe:2.3:a:oracle:instantis_enterprisetrack:17.1:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:a:oracle:instantis_enterprisetrack:17.1:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:instantis_enterprisetrack:17.2:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:instantis_enterprisetrack:17.3:*:*:*:*:*:*:*
Oracle Corporation/Insurance Policy Administration J2ee3 versions
cpe:2.3:a:oracle:insurance_policy_administration_j2ee:11.0.2:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:a:oracle:insurance_policy_administration_j2ee:11.0.2:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:insurance_policy_administration_j2ee:11.1.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:insurance_policy_administration_j2ee:11.2.0:*:*:*:*:*:*:*
Oracle Corporation/Insurance Rules Palette5 versions
cpe:2.3:a:oracle:insurance_rules_palette:10.2.0:*:*:*:*:*:*:*+ 4 more
- cpe:2.3:a:oracle:insurance_rules_palette:10.2.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:insurance_rules_palette:10.2.4:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:insurance_rules_palette:11.0.2:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:insurance_rules_palette:11.1.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:insurance_rules_palette:11.2.0:*:*:*:*:*:*:*
Oracle Corporation/Jdeveloper
cpe:2.3:a:oracle:jdeveloper:12.2.1.4.0:*:*:*:*:*:*:*
Oracle Corporation/Peoplesoft Enterprise Peopletools3 versions
cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.57:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.57:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.59:*:*:*:*:*:*:*
Oracle Corporation/Primavera Gateway2 versions
cpe:2.3:a:oracle:primavera_gateway:17.12.6:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:oracle:primavera_gateway:17.12.6:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:primavera_gateway:18.8.8.1:*:*:*:*:*:*:*
Oracle Corporation/Primavera Unifier5 versions
cpe:2.3:a:oracle:primavera_unifier:*:*:*:*:*:*:*:*+ 4 more
- cpe:2.3:a:oracle:primavera_unifier:*:*:*:*:*:*:*:*range: >=17.7,<=17.12
- cpe:2.3:a:oracle:primavera_unifier:16.1:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:primavera_unifier:16.2:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:primavera_unifier:18.8:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:primavera_unifier:19.12:*:*:*:*:*:*:*
Oracle Corporation/Retail Clearance Optimization Engine
cpe:2.3:a:oracle:retail_clearance_optimization_engine:14.0:*:*:*:*:*:*:*
Oracle Corporation/Retail Order Broker2 versions
cpe:2.3:a:oracle:retail_order_broker:15.0:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:oracle:retail_order_broker:15.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:retail_order_broker:16.0:*:*:*:*:*:*:*
Oracle Corporation/Retail Predictive Application Server2 versions
cpe:2.3:a:oracle:retail_predictive_application_server:15.0.3:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:oracle:retail_predictive_application_server:15.0.3:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:retail_predictive_application_server:16.0.3:*:*:*:*:*:*:*
Oracle Corporation/Webcenter Portal2 versions
cpe:2.3:a:oracle:webcenter_portal:12.2.1.3.0:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:oracle:webcenter_portal:12.2.1.3.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:webcenter_portal:12.2.1.4.0:*:*:*:*:*:*:*
Oracle Corporation/Webcenter Sites2 versions
cpe:2.3:a:oracle:webcenter_sites:12.2.1.3.0:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:oracle:webcenter_sites:12.2.1.3.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:webcenter_sites:12.2.1.4.0:*:*:*:*:*:*:*
ghsa-coords
pkg:maven/org.apache.poi/poi
Range: < 4.1.1

Patches

Vulnerability mechanics

References

github.com/advisories/GHSA-9jwc-q6j3-8g9gghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2019-12415ghsaADVISORY
www.oracle.com//security-alerts/cpujul2021.htmlnvdThird Party AdvisoryWEB
www.oracle.com/security-alerts/cpuApr2021.htmlnvdThird Party AdvisoryWEB
www.oracle.com/security-alerts/cpuapr2020.htmlnvdThird Party AdvisoryWEB
www.oracle.com/security-alerts/cpujan2020.htmlnvdThird Party AdvisoryWEB
www.oracle.com/security-alerts/cpujan2021.htmlnvdThird Party AdvisoryWEB
www.oracle.com/security-alerts/cpujul2020.htmlnvdThird Party AdvisoryWEB
www.oracle.com/security-alerts/cpuoct2020.htmlnvdThird Party AdvisoryWEB
www.oracle.com/security-alerts/cpuoct2021.htmlnvdThird Party AdvisoryWEB
lists.apache.org/thread.html/13a54b6a03369cfb418a699180ffb83bd727320b6ddfec198b9b728e@%3Cannounce.apache.org%3EghsaWEB
lists.apache.org/thread.html/2ac0327748de0c2b3c1c012481b79936797c711724e0b7da83cf564c@%3Cuser.tika.apache.org%3EghsaWEB
lists.apache.org/thread.html/895164e03a3c327449069e2fd6ced0367561878b3ae6a8ec740c2007@%3Cuser.tika.apache.org%3EghsaWEB
lists.apache.org/thread.html/d88b8823867033514d7ec05d66f88c70dc207604d3dcbd44fd88464c@%3Cuser.tika.apache.org%3EghsaWEB
lists.apache.org/thread.html/r204ba2a9ea750f38d789d2bb429cc0925ad6133deea7cbc3001d96b5@%3Csolr-user.lucene.apache.org%3EghsaWEB
lists.apache.org/thread.html/13a54b6a03369cfb418a699180ffb83bd727320b6ddfec198b9b728e%40%3Cannounce.apache.org%3Envd
lists.apache.org/thread.html/2ac0327748de0c2b3c1c012481b79936797c711724e0b7da83cf564c%40%3Cuser.tika.apache.org%3Envd
lists.apache.org/thread.html/895164e03a3c327449069e2fd6ced0367561878b3ae6a8ec740c2007%40%3Cuser.tika.apache.org%3Envd
lists.apache.org/thread.html/d88b8823867033514d7ec05d66f88c70dc207604d3dcbd44fd88464c%40%3Cuser.tika.apache.org%3Envd
lists.apache.org/thread.html/r204ba2a9ea750f38d789d2bb429cc0925ad6133deea7cbc3001d96b5%40%3Csolr-user.lucene.apache.org%3Envd

News mentions

No linked articles in our index yet.

cvss	0.358
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000