CVE-2019-12415 Apache POI
| Affected software | Apache POI |
|---|---|
| Severity | 5.5 Medium CVSS 3.1 2 scores |
| Fixed in | 4.1.1 |
| Weakness | XML external entity (XXE) (CWE-611) |
| Published | 23 Oct 2019 |
| Updated | 17 Jun 2026 |
Description
In Apache POI up to 4.1.0, when using the tool XSSFExportToXml to convert user-provided Microsoft Excel documents, a specially crafted document can allow an attacker to read files from the local filesystem or from internal network resources via XML External Entity (XXE) Processing.
Exploitation status
No public exploit
No exploit has been reported in the sources we check. Published 7 years ago.
Exploitation status
- CISA KEV not listed
- VulnCheck KEV not listed
- CISA Vulnrichment no assessment published
- Indexed PoC none indexed
- EPSS 1.00% chance in 30 days
Waratek protection
Waratek has a rule that blocks attacks on this vulnerability.
- Protection full
- Action available security rule
- Review human Researcher
- Record active
| Decided by | Manual classification of this CVE in the legacy dataset |
|---|---|
| Finding | A manual classification set this CVE's status to Protected by Waratek. |
How to mitigate CVE-2019-12415
Upgrade Apache POI to 4.1.1 or later. Until you can, Waratek RASP blocks exploitation with a security rule that blocks this kind of attack. It runs inside the Java application, with no code changes.
Waratek RASP Runtime protection for Java applications
CVSS
5.5 MEDIUM
v3.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
2 metrics
CVSS
5.5 MEDIUM v3.1CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
2 metrics
We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.
| Version | Score | Band | Vector | Assigner | Type | |
|---|---|---|---|---|---|---|
| CVSS 3.1 | 5.5 | MEDIUM | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
NVD | Primary | published |
| CVSS 2.0 | 2.1 | none | AV:L/AC:L/Au:N/C:P/I:N/A:N |
NVD | Primary |
Affected software and releases
Oracle advisories
| Advisory | Type | Quarter | Products Oracle names in its risk matrix |
|---|---|---|---|
| Oracle Critical Patch Update January 2025 ↗ | CPU | 2025-Q1 | Oracle Fusion Middleware / Runtime Engine (Apache POI) (12.2.1.4.0) |
| Oracle Critical Patch Update April 2023 ↗ | CPU | 2023-Q2 | Oracle Financial Services Applications / Infrastructure (Apache POI) (2.7, 2.8, 2.9) |
| Oracle Critical Patch Update January 2023 ↗ | CPU | 2023-Q1 | Oracle Supply Chain / Installation (Apache POI) (Prior to 21.0.2.0) Oracle's note: This vulnerability applies to Oracle AutoVue Office, Oracle AutoVue 2D Professional, Oracle AutoVue 3D Professional Advanced, Oracle AutoVue EDA Professional and Oracle AutoVue Electro-Mechanical Professional. Please refer to Patch Availability Document for more details. |
| Oracle Critical Patch Update October 2022 ↗ | CPU | 2022-Q4 | Oracle Insurance Applications / Framework Administrator IBFA (Apache POI) (5.2.0, 5.4.0-5.6.2) |
| Oracle Critical Patch Update October 2021 ↗ | CPU | 2021-Q4 | Oracle Fusion Middleware / WebCenter Sites (Apache POI) (12.2.1.3.0, 12.2.1.4.0) Oracle PeopleSoft / nVision (Apache POI) (8.57, 8.58, 8.59) |
| Oracle Critical Patch Update July 2021 ↗ | CPU | 2021-Q3 | Oracle Fusion Middleware / OAM (Apache POI) (12.2.1.4.0) |
| Oracle Critical Patch Update January 2021 ↗ | CPU | 2021-Q1 | Oracle Hyperion / Common Security (Apache POI) (11.1.2.4) |
| Oracle Critical Patch Update October 2020 ↗ | CPU | 2020-Q4 | Oracle Communications / IDIH (Apache POI) (IDIH: 8.0.0-8.2.2) Oracle Retail Applications / Store Connect (Apache POI) (15.0, 16.0) |
| Oracle Critical Patch Update July 2020 ↗ | CPU | 2020-Q3 | Oracle Enterprise Manager / Application Service Level Mgmt (Apache POI) (12.1.0.5, 13.3.0.0, 13.4.0.0) Oracle Financial Services Applications / Core (Apache POI) (12.0.0, 12.1.0) Oracle Financial Services Applications / Core (Apache POI) (14.1.0-14.4.0) Oracle Fusion Middleware / Security Framework (Apache POI) (12.2.1.3.0, 12.2.1.4.0) Oracle Insurance Applications / Architecture (Apache POI) (10.2.0, 10.2.4, 11.0.2, 11.1.0, 11.2.0) Oracle Insurance Applications / Architecture (Apache POI) (11.0.2, 11.1.0, 11.2.0) |
| Oracle Critical Patch Update April 2020 ↗ | CPU | 2020-Q2 | Oracle Construction and Engineering / Office Open document processor (Apache POI) (17.1 - 17.3) Oracle Financial Services Applications / Core (Apache POI) (2.4.0, 2.4.1, 2.5.0, 2.6.0, 2.6.1, 2.6.2, 2.7.0, 2.7.1, 2.9.0) Oracle Financial Services Applications / Core (Apache POI) (2.7.0, 2.8.0) Oracle Financial Services Applications / Core (Apache POI) (2.7.0, 2.8.0) Oracle Financial Services Applications / Infrastructure (Apache POI) (8.0.6 - 8.0.9) Oracle Financial Services Applications / Infrastructure (Apache POI) (8.0.6, 8.0.8) Oracle Fusion Middleware / Studio (Apache POI) (1.6) |
| Oracle Critical Patch Update January 2020 ↗ | CPU | 2020-Q1 | Oracle Construction and Engineering / Admin (Apache POI) (17.12.6, 18.8.8.1) Oracle Construction and Engineering / Core (Apache POI) (16.1, 16.2, 17.7-17.12, 18.8, 19.12) Oracle Enterprise Manager / Load Testing for Web Apps (Apache POI) (12.5.0.3, 13.1.0.1, 13.2.0.1, 13.3.0.1) Oracle Fusion Middleware / Security Subsystem (Apache POI) (12.1.3.0.0) Oracle Fusion Middleware / Studio (Apache POI) (3.2.0) Oracle Retail Applications / General Application (Apache POI) (14.0) Oracle Retail Applications / RPAS Fusion Client (Apache POI) (15.0.3) Oracle Retail Applications / RPAS Fusion Client (Apache POI) (15.0.3, 16.0.3) |
Oracle components and versions
| Family | Component | Versions, as Oracle lists them | Read as |
|---|---|---|---|
| Oracle Communications | IDIH (Apache POI) | IDIH: 8.0.0-8.2.2 | |
| Oracle Construction and Engineering | Admin (Apache POI) | 17.12.6, 18.8.8.1 | 17.12.6 · 18.8.8.1 |
| Oracle Construction and Engineering | Core (Apache POI) | 16.1, 16.2, 17.7-17.12, 18.8, 19.12 | 16.1 · 16.2 · 18.8 · 19.12 |
| Oracle Construction and Engineering | Office Open document processor (Apache POI) | 17.1 - 17.3 | |
| Oracle Enterprise Manager | Application Service Level Mgmt (Apache POI) | 12.1.0.5, 13.3.0.0, 13.4.0.0 | 12.1.0.5 · 13.3.0.0 · 13.4.0.0 |
| Oracle Enterprise Manager | Load Testing for Web Apps (Apache POI) | 12.5.0.3, 13.1.0.1, 13.2.0.1, 13.3.0.1 | 12.5.0.3 · 13.1.0.1 · 13.2.0.1 · 13.3.0.1 |
| Oracle Financial Services Applications | Core (Apache POI) | 14.1.0-14.4.0 | 2.4.0 · 2.4.1 · 2.5.0 · 2.6.0 · 2.6.1 · 2.6.2 · 2.7.0 · 2.7.1 · 2.8.0 · 2.9.0 · 12.0.0 · 12.1.0 |
| Oracle Financial Services Applications | Infrastructure (Apache POI) | 8.0.6 - 8.0.9 | 2.7 · 2.8 · 2.9 · 8.0.6 · 8.0.8 |
| Oracle Fusion Middleware | OAM (Apache POI) | 12.2.1.4.0 | 12.2.1.4.0 |
| Oracle Fusion Middleware | Runtime Engine (Apache POI) | 12.2.1.4.0 | 12.2.1.4.0 |
| Oracle Fusion Middleware | Security Framework (Apache POI) | 12.2.1.3.0, 12.2.1.4.0 | 12.2.1.3.0 · 12.2.1.4.0 |
| Oracle Fusion Middleware | Security Subsystem (Apache POI) | 12.1.3.0.0 | 12.1.3.0.0 |
| Oracle Fusion Middleware | Studio (Apache POI) | 1.6 | 1.6 · 3.2.0 |
| Oracle Fusion Middleware | WebCenter Sites (Apache POI) | 12.2.1.3.0, 12.2.1.4.0 | 12.2.1.3.0 · 12.2.1.4.0 |
| Oracle Hyperion | Common Security (Apache POI) | 11.1.2.4 | 11.1.2.4 |
| Oracle Insurance Applications | Architecture (Apache POI) | 10.2.0, 10.2.4, 11.0.2, 11.1.0, 11.2.0 | 10.2.0 · 10.2.4 · 11.0.2 · 11.1.0 · 11.2.0 |
| Oracle Insurance Applications | Framework Administrator IBFA (Apache POI) | 5.2.0, 5.4.0-5.6.2 | 5.2.0 |
| Oracle PeopleSoft | nVision (Apache POI) | 8.57, 8.58, 8.59 | 8.57 · 8.58 · 8.59 |
| Oracle Retail Applications | General Application (Apache POI) | 14.0 | 14.0 |
| Oracle Retail Applications | RPAS Fusion Client (Apache POI) | 15.0.3 | 15.0.3 · 16.0.3 |
| Oracle Retail Applications | Store Connect (Apache POI) | 15.0, 16.0 | 15.0 · 16.0 |
| Oracle Supply Chain | Installation (Apache POI) | Prior to 21.0.2.0 |
Maven packages
Affected and fixed versions, from OSV.dev| Package | Introduced | Fixed | Last affected |
|---|---|---|---|
org.apache.poi:poi |
0 | 4.1.1 |
unbounded |
Products and versions
28 products, 66 version entries| Source | Vendor | Product | Scheme | Affected versions |
|---|---|---|---|---|
| nvd | apache | poi | generic | ≤ 4.1.0 |
| nvd | oracle | application testing suite | generic | 12.5.0.3 · 13.1.0.1 · 13.2.0.1 · 13.3.0.1 |
| nvd | oracle | banking enterprise originations | generic | 2.7.0 · 2.8.0 |
| nvd | oracle | banking enterprise product manufacturing | generic | 2.7.0 · 2.8.0 |
| nvd | oracle | banking payments | generic | 14.0.0 · 14.1.0 |
| nvd | oracle | banking platform | generic | 2.4.0 · 2.4.1 · 2.5.0 · 2.6.0 · 2.6.1 · 2.6.2 · 2.7.0 · 2.7.1 · 2.9.0 |
| nvd | oracle | big data discovery | generic | 1.6 |
| nvd | oracle | communications diameter signaling router idih\ | generic | any version |
| nvd | oracle | endeca information discovery studio | generic | 3.2.0 |
| nvd | oracle | enterprise manager base platform | generic | 12.1.0.5 · 13.3.0.0 · 13.4.0.0 |
| nvd | oracle | enterprise repository | generic | 12.1.3.0.0 |
| nvd | oracle | financial services analytical applications infrastructure | generic | ≥ 8.0.6 and ≤ 8.0.9 |
| nvd | oracle | financial services market risk measurement and management | generic | 8.0.6 · 8.0.8 |
| nvd | oracle | flexcube private banking | generic | 12.0.0 · 12.1.0 |
| nvd | oracle | hyperion infrastructure technology | generic | 11.1.2.4 |
| nvd | oracle | instantis enterprisetrack | generic | 17.1 · 17.2 · 17.3 |
| nvd | oracle | insurance policy administration j2ee | generic | 11.0.2 · 11.1.0 · 11.2.0 |
| nvd | oracle | insurance rules palette | generic | 10.2.0 · 10.2.4 · 11.0.2 · 11.1.0 · 11.2.0 |
| nvd | oracle | jdeveloper | generic | 12.2.1.4.0 |
| nvd | oracle | peoplesoft enterprise peopletools | generic | 8.57 · 8.58 · 8.59 |
| nvd | oracle | primavera gateway | generic | 17.12.6 · 18.8.8.1 |
| nvd | oracle | primavera unifier | generic | 16.1 · 16.2 · ≥ 17.7 and ≤ 17.12 · 18.8 · 19.12 |
| nvd | oracle | retail clearance optimization engine | generic | 14.0 |
| nvd | oracle | retail order broker | generic | 15.0 · 16.0 |
| nvd | oracle | retail predictive application server | generic | 15.0.3 · 16.0.3 |
| nvd | oracle | webcenter portal | generic | 12.2.1.3.0 · 12.2.1.4.0 |
| nvd | oracle | webcenter sites | generic | 12.2.1.3.0 · 12.2.1.4.0 |
| osv | org.apache.poi | poi | generic | ＜ 4.1.1 |
Earlier manual review
A reviewer classified this CVE in an older dataset. We kept the labels and products below, but not the reviewer's reasoning.
## Manual Classification Context **Labels:** LOAD TESTING FOR WEB APPS (APACHE POI), SECURITY FRAMEWORK (APACHE POI), APPLICATION SERVICE LEVEL MGMT (APACHE POI), IDIH (APACHE POI), ARCHITECTURE (APACHE POI), NVISION (APACHE POI), ADMIN (APACHE POI), CORE (APACHE POI), STORE CONNECT (APACHE POI), OAM (APACHE POI), WEBCENTER SITES (APACHE POI), SECURITY SUBSYSTEM (APACHE POI), INFRASTRUCTURE (APACHE POI), RPAS FUSION CLIENT (APACHE POI), STUDIO (APACHE POI), OFFICE OPEN DOCUMENT PROCESSOR (APACHE POI), GENERAL APPLICATION (APACHE POI), COMMON SECURITY (APACHE POI) **Products:** PRIMAVERA UNIFIER, ORACLE JDEVELOPER, ORACLE ENTERPRISE MANAGER, ORACLE BANKING PLATFORM, ORACLE BANKING PAYMENTS, HYPERION INFRASTRUCTURE TECHNOLOGY, ORACLE BANKING ENTERPRISE PRODUCT MANUFACTURING, ORACLE RETAIL PREDICTIVE APPLICATION SERVER, ORACLE RETAIL CLEARANCE OPTIMIZATION ENGINE, ORACLE WEBCENTER PORTAL, ORACLE FINANCIAL SERVICES APPLICATIONS, ORACLE PEOPLESOFT, ORACLE RETAIL APPLICATIONS, ORACLE INSURANCE POLICY ADMINISTRATION J2EE, ORACLE APPLICATION TESTING SUITE, ORACLE FINANCIAL SERVICES ANALYTICAL APPLICATIONS INFRASTRUCTURE, POI, ENTERPRISE MANAGER BASE PLATFORM, ORACLE CONSTRUCTION AND ENGINEERING, ORACLE WEBCENTER SITES, ORACLE INSURANCE APPLICATIONS, ORACLE BANKING ENTERPRISE ORIGINATIONS, ORACLE FLEXCUBE PRIVATE BANKING, ORACLE COMMUNICATIONS DIAMETER SIGNALING ROUTER (DSR), PRIMAVERA GATEWAY, ORACLE FUSION MIDDLEWARE, ORACLE ENTERPRISE REPOSITORY, ORACLE COMMUNICATIONS, ORACLE BIG DATA DISCOVERY, ORACLE FINANCIAL SERVICES MARKET RISK MEASUREMENT AND MANAGEMENT, INSTANTIS ENTERPRISETRACK, ORACLE RETAIL ORDER BROKER, ORACLE INSURANCE RULES PALETTE, ORACLE HYPERION, PEOPLESOFT ENTERPRISE PEOPLETOOLS, ORACLE ENDECA INFORMATION DISCOVERY STUDIO
References
Timeline
Timeline
| Published | 2019-10-23 | By the CVE Program. |
|---|---|---|
| NVD record modified | 2026-06-17 | NVD's own last-modified date for this record. |