Staging Environment: Content and features may be unstable or change without notice.
Advisory details: github_osv / GHSA-q56h-jjj6-52mf
Advisory ID github_osv/GHSA-q56h-jjj6-52mf
Aliases CVE-2014-3529
Summary Improper Restriction of XML External Entity Reference in Apache POI The OPC SAX setup in Apache POI before 3.10.1 allows remote attackers to read arbitrary files via an OpenXML file containing an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
Status Published
Exploitability 0.5
Weighted Severity 0.0
Risk
Affected and Fixed Packages Package Details
Introduced and Fixed Package Commit Patches Package Commit Patches Details
Weaknesses (1)
CWE-611 Improper Restriction of XML External Entity Reference
System Score Found at
generic_textual MODERATE
Reference id Reference type URL
http://poi.apache.org/changes.html
https://exchange.xforce.ibmcloud.com/vulnerabilities/95770
https://github.com/apache/poi
https://github.com/apache/poi/commit/103b45073c7b504236588b3acc146530205af53c
https://github.com/apache/poi/commit/236c3c52a9b90688b2e57ec503559409e29f33ed
https://github.com/apache/poi/commit/6050a68d5adfb4ffef1edb778add09bcee32d1c3
https://github.com/apache/poi/commit/d72bd78c19dfb7b57395a66ae8d9269d59a87bd2
https://github.com/apache/poi/commit/eabb6a924be24abb879372d0bc967e0d316b2cf8
https://lucene.apache.org/solr/solrnews.html#18-august-2014-recommendation-to-update-apache-poi-in-apache-solr-480-481-and-490-installations
http://www-01.ibm.com/support/docview.wss?uid=swg21996759
http://www.apache.org/dist/poi/release/RELEASE-NOTES.txt
CVE-2014-3529 https://nvd.nist.gov/vuln/detail/CVE-2014-3529
RHSA-2014-1370.html http://rhn.redhat.com/errata/RHSA-2014-1370.html
RHSA-2014-1398.html http://rhn.redhat.com/errata/RHSA-2014-1398.html
RHSA-2014-1399.html http://rhn.redhat.com/errata/RHSA-2014-1399.html
RHSA-2014-1400.html http://rhn.redhat.com/errata/RHSA-2014-1400.html
No exploits are available.

No EPSS data available for this advisory.

Patch URL
There are no known patches.
There are no known vectors.

There are no SSVC decisions available.