Medium
Security advisory
In Apache POI up to 4.1.0, when using the tool XSSFExportToXml to convert user-provided Microsoft Excel documents, a specially crafted document can allow an attacker to read files from the local filesystem or from internal network resources via XML External Entity (XXE) Processing.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2019-12415
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 07:44 UTC · Revision 1
Source evidence
In Apache POI up to 4.1.0, when using the tool XSSFExportToXml to convert user-provided Microsoft Excel documents, a specially crafted document can allow an attacker to read files from the local filesystem or from internal network resources via XML External Entity (XXE) Processing.
osv:CVE-2019-12415
Complete source record
{
"id": "81b441ed6484760d842cc251e88090f0895954eca5df35d969aef9d5c1a9cf4e",
"url": "https://osv.dev/vulnerability/CVE-2019-12415",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2019-12415",
"summary": "In Apache POI up to 4.1.0, when using the tool XSSFExportToXml to convert user-provided Microsoft Excel documents, a specially crafted document can allow an attacker to read files from the local filesystem or from internal network resources via XML External Entity (XXE) Processing.",
"evidence": "osv:CVE-2019-12415",
"products": [],
"severity": "medium",
"structured": {
"id": "CVE-2019-12415",
"aliases": [
"CVE-2019-12415",
"GHSA-9jwc-q6j3-8g9g"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/apache/poi",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"last_affected": "444e35e0d903f0b4fac96e8c8668953b196dabd4"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:apache:poi:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"last_affected": "4.1.0"
}
],
"source": "CPE_RANGE"
}
]
}
}
],
"versions": [
"REL_4_1_0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-12415.json"
}
}
],
"modified": "2026-10-24T10:30:57.808500234Z",
"provider": "osv",
"references": [
"https://lists.apache.org/thread.html/13a54b6a03369cfb418a699180ffb83bd727320b6ddfec198b9b728e%40%3Cannounce.apache.org%3E",
"https://lists.apache.org/thread.html/2ac0327748de0c2b3c1c012481b79936797c711724e0b7da83cf564c%40%3Cuser.tika.apache.org%3E",
"https://lists.apache.org/thread.html/895164e03a3c327449069e2fd6ced0367561878b3ae6a8ec740c2007%40%3Cuser.tika.apache.org%3E",
"https://lists.apache.org/thread.html/d88b8823867033514d7ec05d66f88c70dc207604d3dcbd44fd88464c%40%3Cuser.tika.apache.org%3E",
"https://lists.apache.org/thread.html/r204ba2a9ea750f38d789d2bb429cc0925ad6133deea7cbc3001d96b5%40%3Csolr-user.lucene.apache.org%3E",
"https://www.oracle.com//security-alerts/cpujul2021.html",
"https://www.oracle.com/security-alerts/cpuApr2021.html",
"https://www.oracle.com/security-alerts/cpuapr2020.html",
"https://www.oracle.com/security-alerts/cpujan2020.html",
"https://www.oracle.com/security-alerts/cpujan2021.html",
"https://www.oracle.com/security-alerts/cpujul2020.html",
"https://www.oracle.com/security-alerts/cpuoct2020.html",
"https://www.oracle.com/security-alerts/cpuoct2021.html"
],
"provider_metadata": {
"unresolved_ranges": [
{
"cpes": [
"cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:*:*:*:*:*:*:*:*"
],
"vendor_product": "oracle:financial_services_analytical_applications_infrastructure",
"extracted_events": [
{
"range": [
{
"introduced": "8.0.6"
},
{
"last_affected": "8.0.9"
}
],
"source": "CPE_RANGE"
}
]
},
{
"cpes": [
"cpe:2.3:a:oracle:primavera_unifier:*:*:*:*:*:*:*:*"
],
"vendor_product": "oracle:primavera_unifier",
"extracted_events": [
{
"range": [
{
"introduced": "17.7"
},
{
"last_affected": "17.12"
}
],
"source": "CPE_RANGE"
}
]
},
{
"cpes": [
"cpe:2.3:a:oracle:application_testing_suite:12.5.0.3:*:*:*:*:*:*:*",
"cpe:2.3:a:oracle:application_testing_suite:13.1.0.1:*:*:*:*:*:*:*",
"cpe:2.3:a:oracle:application_testing_suite:13.2.0.1:*:*:*:*:*:*:*",
"cpe:2.3:a:oracle:application_testing_suite:13.3.0.1:*:*:*:*:*:*:*"
],
"vendor_product": "oracle:application_testing_suite",
"extracted_events": [
{
"range": [
{
"introduced": "12.5.0.3"
},
{
"last_affected": "12.5.0.3"
},
{
"introduced": "13.1.0.1"
},
{
"last_affected": "13.1.0.1"
},
{
"introduced": "13.2.0.1"
},
{
"last_affected": "13.2.0.1"
},
{
"introduced": "13.3.0.1"
},
{
"last_affected": "13.3.0.1"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:a:oracle:banking_enterprise_originations:2.7.0:*:*:*:*:*:*:*",
"cpe:2.3:a:oracle:banking_enterprise_originations:2.8.0:*:*:*:*:*:*:*"
],
"vendor_product": "oracle:banking_enterprise_originations",
"extracted_events": [
{
"range": [
{
"introduced": "2.7.0"
},
{
"last_affected": "2.7.0"
},
{
"introduced": "2.8.0"
},
{
"last_affected": "2.8.0"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:a:oracle:banking_enterprise_product_manufacturing:2.7.0:*:*:*:*:*:*:*",
"cpe:2.3:a:oracle:banking_enterprise_product_manufacturing:2.8.0:*:*:*:*:*:*:*"
],
"vendor_product": "oracle:banking_enterprise_product_manufacturing",
"extracted_events": [
{
"range": [
{
"introduced": "2.7.0"
},
{
"last_affected": "2.7.0"
},
{
"introduced": "2.8.0"
},
{
"last_affected": "2.8.0"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:a:oracle:banking_payments:14.0.0:*:*:*:*:*:*:*",
"cpe:2.3:a:oracle:banking_payments:14.1.0:*:*:*:*:*:*:*"
],
"vendor_product": "oracle:banking_payments",
"extracted_events": [
{
"range": [
{
"introduced": "14.0.0"
},
{
"last_affected": "14.0.0"
},
{
"introduced": "14.1.0"
},
{
"last_affected": "14.1.0"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:a:oracle:banking_platform:2.4.0:*:*:*:*:*:*:*",
"cpe:2.3:a:oracle:banking_platform:2.4.1:*:*:*:*:*:*:*",
"cpe:2.3:a:oracle:banking_platform:2.5.0:*:*:*:*:*:*:*",
"cpe:2.3:a:oracle:banking_platform:2.6.0:*:*:*:*:*:*:*",
"cpe:2.3:a:oracle:banking_platform:2.6.1:*:*:*:*:*:*:*",
"cpe:2.3:a:oracle:banking_platform:2.6.2:*:*:*:*:*:*:*",
"cpe:2.3:a:oracle:banking_platform:2.7.0:*:*:*:*:*:*:*",
"cpe:2.3:a:oracle:banking_platform:2.7.1:*:*:*:*:*:*:*",
"cpe:2.3:a:oracle:banking_platform:2.9.0:*:*:*:*:*:*:*"
],
"vendor_product": "oracle:banking_platform",
"extracted_events": [
{
"range": [
{
"introduced": "2.4.0"
},
{
"last_affected": "2.4.0"
},
{
"introduced": "2.4.1"
},
{
"last_affected": "2.4.1"
},
{
"introduced": "2.5.0"
},
{
"last_affected": "2.5.0"
},
{
"introduced": "2.6.0"
},
{
"last_affected": "2.6.0"
},
{
"introduced": "2.6.1"
},
{
"last_affected": "2.6.1"
},
{
"introduced": "2.6.2"
},
{
"last_affected": "2.6.2"
},
{
"introduced": "2.7.0"
},
{
"last_affected": "2.7.0"
},
{
"introduced": "2.7.1"
},
{
"last_affected": "2.7.1"
},
{
"introduced": "2.9.0"
},
{
"last_affected": "2.9.0"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:a:oracle:big_data_discovery:1.6:*:*:*:*:*:*:*"
],
"vendor_product": "oracle:big_data_discovery",
"extracted_events": [
{
"range": [
{
"introduced": "1.6"
},
{
"last_affected": "1.6"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:a:oracle:communications_diameter_signaling_router_idih\\::8.0.0:*:*:*:*:*:*:*",
"cpe:2.3:a:oracle:communications_diameter_signaling_router_idih\\::8.2.2:*:*:*:*:*:*:*"
],
"vendor_product": "oracle:communications_diameter_signaling_router_idih:",
"extracted_events": [
{
"range": [
{
"introduced": "8.0.0"
},
{
"last_affected": "8.0.0"
},
{
"introduced": "8.2.2"
},
{
"last_affected": "8.2.2"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:a:oracle:endeca_information_discovery_studio:3.2.0:*:*:*:*:*:*:*"
],
"vendor_product": "oracle:endeca_information_discovery_studio",
"extracted_events": [
{
"range": [
{
"introduced": "3.2.0"
},
{
"last_affected": "3.2.0"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:a:oracle:enterprise_manager_base_platform:12.1.0.5:*:*:*:*:*:*:*",
"cpe:2.3:a:oracle:enterprise_manager_base_platform:13.3.0.0:*:*:*:*:*:*:*",
"cpe:2.3:a:oracle:enterprise_manager_base_platform:13.4.0.0:*:*:*:*:*:*:*"
],
"vendor_product": "oracle:enterprise_manager_base_platform",
"extracted_events": [
{
"range": [
{
"introduced": "12.1.0.5"
},
{
"last_affected": "12.1.0.5"
},
{
"introduced": "13.3.0.0"
},
{
"last_affected": "13.3.0.0"
},
{
"introduced": "13.4.0.0"
},
{
"last_affected": "13.4.0.0"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:a:oracle:enterprise_repository:12.1.3.0.0:*:*:*:*:*:*:*"
],
"vendor_product": "oracle:enterprise_repository",
"extracted_events": [
{
"range": [
{
"introduced": "12.1.3.0.0"
},
{
"last_affected": "12.1.3.0.0"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:a:oracle:financial_services_market_risk_measurement_and_management:8.0.6:*:*:*:*:*:*:*",
"cpe:2.3:a:oracle:financial_services_market_risk_measurement_and_management:8.0.8:*:*:*:*:*:*:*"
],
"vendor_product": "oracle:financial_services_market_risk_measurement_and_management",
"extracted_events": [
{
"range": [
{
"introduced": "8.0.6"
},
{
"last_affected": "8.0.6"
},
{
"introduced": "8.0.8"
},
{
"last_affected": "8.0.8"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:a:oracle:flexcube_private_banking:12.0.0:*:*:*:*:*:*:*",
"cpe:2.3:a:oracle:flexcube_private_banking:12.1.0:*:*:*:*:*:*:*"
],
"vendor_product": "oracle:flexcube_private_banking",
"extracted_events": [
{
"range": [
{
"introduced": "12.0.0"
},
{
"last_affected": "12.0.0"
},
{
"introduced": "12.1.0"
},
{
"last_affected": "12.1.0"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:a:oracle:hyperion_infrastructure_technology:11.1.2.4:*:*:*:*:*:*:*"
],
"vendor_product": "oracle:hyperion_infrastructure_technology",
"extracted_events": [
{
"range": [
{
"introduced": "11.1.2.4"
},
{
"last_affected": "11.1.2.4"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:a:oracle:instantis_enterprisetrack:17.1:*:*:*:*:*:*:*",
"cpe:2.3:a:oracle:instantis_enterprisetrack:17.2:*:*:*:*:*:*:*",
"cpe:2.3:a:oracle:instantis_enterprisetrack:17.3:*:*:*:*:*:*:*"
],
"vendor_product": "oracle:instantis_enterprisetrack",
"extracted_events": [
{
"range": [
{
"introduced": "17.1"
},
{
"last_affected": "17.1"
},
{
"introduced": "17.2"
},
{
"last_affected": "17.2"
},
{
"introduced": "17.3"
},
{
"last_affected": "17.3"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:a:oracle:insurance_policy_administration_j2ee:11.0.2:*:*:*:*:*:*:*",
"cpe:2.3:a:oracle:insurance_policy_administration_j2ee:11.1.0:*:*:*:*:*:*:*",
"cpe:2.3:a:oracle:insurance_policy_administration_j2ee:11.2.0:*:*:*:*:*:*:*"
],
"vendor_product": "oracle:insurance_policy_administration_j2ee",
"extracted_events": [
{
"range": [
{
"introduced": "11.0.2"
},
{
"last_affected": "11.0.2"
},
{
"introduced": "11.1.0"
},
{
"last_affected": "11.1.0"
},
{
"introduced": "11.2.0"
},
{
"last_affected": "11.2.0"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:a:oracle:insurance_rules_palette:10.2.0:*:*:*:*:*:*:*",
"cpe:2.3:a:oracle:insurance_rules_palette:10.2.4:*:*:*:*:*:*:*",
"cpe:2.3:a:oracle:insurance_rules_palette:11.0.2:*:*:*:*:*:*:*",
"cpe:2.3:a:oracle:insurance_rules_palette:11.1.0:*:*:*:*:*:*:*",
"cpe:2.3:a:oracle:insurance_rules_palette:11.2.0:*:*:*:*:*:*:*"
],
"vendor_product": "oracle:insurance_rules_palette",
"extracted_events": [
{
"range": [
{
"introduced": "10.2.0"
},
{
"last_affected": "10.2.0"
},
{
"introduced": "10.2.4"
},
{
"last_affected": "10.2.4"
},
{
"introduced": "11.0.2"
},
{
"last_affected": "11.0.2"
},
{
"introduced": "11.1.0"
},
{
"last_affected": "11.1.0"
},
{
"introduced": "11.2.0"
},
{
"last_affected": "11.2.0"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:a:oracle:jdeveloper:12.2.1.4.0:*:*:*:*:*:*:*"
],
"vendor_product": "oracle:jdeveloper",
"extracted_events": [
{
"range": [
{
"introduced": "12.2.1.4.0"
},
{
"last_affected": "12.2.1.4.0"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.57:*:*:*:*:*:*:*",
"cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58:*:*:*:*:*:*:*",
"cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.59:*:*:*:*:*:*:*"
],
"vendor_product": "oracle:peoplesoft_enterprise_peopletools",
"extracted_events": [
{
"range": [
{
"introduced": "8.57"
},
{
"last_affected": "8.57"
},
{
"introduced": "8.58"
},
{
"last_affected": "8.58"
},
{
"introduced": "8.59"
},
{
"last_affected": "8.59"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:a:oracle:primavera_gateway:17.12.6:*:*:*:*:*:*:*",
"cpe:2.3:a:oracle:primavera_gateway:18.8.8.1:*:*:*:*:*:*:*"
],
"vendor_product": "oracle:primavera_gateway",
"extracted_events": [
{
"range": [
{
"introduced": "17.12.6"
},
{
"last_affected": "17.12.6"
},
{
"introduced": "18.8.8.1"
},
{
"last_affected": "18.8.8.1"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:a:oracle:primavera_unifier:16.1:*:*:*:*:*:*:*",
"cpe:2.3:a:oracle:primavera_unifier:16.2:*:*:*:*:*:*:*",
"cpe:2.3:a:oracle:primavera_unifier:18.8:*:*:*:*:*:*:*",
"cpe:2.3:a:oracle:primavera_unifier:19.12:*:*:*:*:*:*:*"
],
"vendor_product": "oracle:primavera_unifier",
"extracted_events": [
{
"range": [
{
"introduced": "16.1"
},
{
"last_affected": "16.1"
},
{
"introduced": "16.2"
},
{
"last_affected": "16.2"
},
{
"introduced": "18.8"
},
{
"last_affected": "18.8"
},
{
"introduced": "19.12"
},
{
"last_affected": "19.12"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:a:oracle:retail_clearance_optimization_engine:14.0:*:*:*:*:*:*:*"
],
"vendor_product": "oracle:retail_clearance_optimization_engine",
"extracted_events": [
{
"range": [
{
"introduced": "14.0"
},
{
"last_affected": "14.0"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:a:oracle:retail_order_broker:15.0:*:*:*:*:*:*:*",
"cpe:2.3:a:oracle:retail_order_broker:16.0:*:*:*:*:*:*:*"
],
"vendor_product": "oracle:retail_order_broker",
"extracted_events": [
{
"range": [
{
"introduced": "15.0"
},
{
"last_affected": "15.0"
},
{
"introduced": "16.0"
},
{
"last_affected": "16.0"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:a:oracle:retail_predictive_application_server:15.0.3:*:*:*:*:*:*:*",
"cpe:2.3:a:oracle:retail_predictive_application_server:16.0.3:*:*:*:*:*:*:*"
],
"vendor_product": "oracle:retail_predictive_application_server",
"extracted_events": [
{
"range": [
{
"introduced": "15.0.3"
},
{
"last_affected": "15.0.3"
},
{
"introduced": "16.0.3"
},
{
"last_affected": "16.0.3"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:a:oracle:webcenter_portal:12.2.1.3.0:*:*:*:*:*:*:*",
"cpe:2.3:a:oracle:webcenter_portal:12.2.1.4.0:*:*:*:*:*:*:*"
],
"vendor_product": "oracle:webcenter_portal",
"extracted_events": [
{
"range": [
{
"introduced": "12.2.1.3.0"
},
{
"last_affected": "12.2.1.3.0"
},
{
"introduced": "12.2.1.4.0"
},
{
"last_affected": "12.2.1.4.0"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:a:oracle:webcenter_sites:12.2.1.3.0:*:*:*:*:*:*:*",
"cpe:2.3:a:oracle:webcenter_sites:12.2.1.4.0:*:*:*:*:*:*:*"
],
"vendor_product": "oracle:webcenter_sites",
"extracted_events": [
{
"range": [
{
"introduced": "12.2.1.3.0"
},
{
"last_affected": "12.2.1.3.0"
},
{
"introduced": "12.2.1.4.0"
},
{
"last_affected": "12.2.1.4.0"
}
],
"source": "CPE_STRING"
}
]
}
]
}
},
"related_cves": [
{
"value": "CVE-2019-12415",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 438932,
"published_at": "2019-10-23T20:15:12.707+00:00"
}