CVE-2016-5000 Apache POI's XLSX2CSV Example XML External Entity (XXE) Vulnerability
MediumCVSS 5.5
EPSS 4.2%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The XLSX2CSV example in Apache POI before 3.14 allows remote attackers to read arbitrary files via a crafted OpenXML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| org.apache.poi/poi-examples(Maven) | <= 3.13 | No fix listed |
| ubuntu/libapache-poi-java(Ubuntu:22.04) | All versions | No fix listed |
| org.apache.poi/poi-examples(Maven) | < 3.14 | 3.14 |
| org.apache.poi/poi-examples(Maven) | = 3.10-FINAL | No fix listed |
| org.apache.poi/poi-examples(Maven) | = 3.10-beta1 | No fix listed |
| org.apache.poi/poi-examples(Maven) | = 3.10-beta2 | No fix listed |
| org.apache.poi/poi-examples(Maven) | = 3.10.1 | No fix listed |
| org.apache.poi/poi-examples(Maven) | = 3.11 | No fix listed |
| org.apache.poi/poi-examples(Maven) | = 3.11-beta1 | No fix listed |
| org.apache.poi/poi-examples(Maven) | = 3.11-beta2 | No fix listed |
| org.apache.poi/poi-examples(Maven) | = 3.11-beta3 | No fix listed |
| org.apache.poi/poi-examples(Maven) | = 3.12 | No fix listed |
| org.apache.poi/poi-examples(Maven) | = 3.12-beta1 | No fix listed |
| org.apache.poi/poi-examples(Maven) | = 3.13 | No fix listed |
| org.apache.poi/poi-examples(Maven) | = 3.13-beta1 | No fix listed |
| org.apache.poi/poi-examples(Maven) | = 3.14-beta1 | No fix listed |
| org.apache.poi/poi-examples(Maven) | = 3.6 | No fix listed |
| org.apache.poi/poi-examples(Maven) | = 3.7 | No fix listed |
| org.apache.poi/poi-examples(Maven) | = 3.7-beta1 | No fix listed |
| org.apache.poi/poi-examples(Maven) | = 3.7-beta2 | No fix listed |
| org.apache.poi/poi-examples(Maven) | = 3.7-beta3 | No fix listed |
| org.apache.poi/poi-examples(Maven) | = 3.8 | No fix listed |
| org.apache.poi/poi-examples(Maven) | = 3.8-beta1 | No fix listed |
| org.apache.poi/poi-examples(Maven) | = 3.8-beta2 | No fix listed |
| org.apache.poi/poi-examples(Maven) | = 3.8-beta3 | No fix listed |
Show 15 more
| Product | Affected versions | Fixed in |
|---|---|---|
| org.apache.poi/poi-examples(Maven) | = 3.8-beta4 | No fix listed |
| org.apache.poi/poi-examples(Maven) | = 3.8-beta5 | No fix listed |
| org.apache.poi/poi-examples(Maven) | = 3.9 | No fix listed |
| debian/libapache-poi-java(Debian:12) | All versions | No fix listed |
| debian/libapache-poi-java(Debian:12) | = 4.0.1-4 | No fix listed |
| debian/libapache-poi-java(Debian:12) | = 4.0.1-5 | No fix listed |
| debian/libapache-poi-java(Debian:12) | = 4.0.1-6 | No fix listed |
| debian/libapache-poi-java(Debian:12) | = 4.1.1-1 | No fix listed |
| debian/libapache-poi-java(Debian:13) | All versions | No fix listed |
| debian/libapache-poi-java(Debian:13) | = 4.0.1-6 | No fix listed |
| debian/libapache-poi-java(Debian:13) | = 4.1.1-1 | No fix listed |
| debian/libapache-poi-java(Debian:14) | All versions | No fix listed |
| debian/libapache-poi-java(Debian:14) | = 4.0.1-6 | No fix listed |
| debian/libapache-poi-java(Debian:14) | = 4.1.1-1 | No fix listed |
| apache poi | <= 3.13 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- lists.apache.org
- www.oracle.com
- www-01.ibm.com
- github.com
- Ubuntu CVE tracker vendor-advisory
- www.cve.org
- Debian Security Tracker CVE-2016-5000 vendor-advisory
- 20160722 [CVE-2016-5000] XML External Entity (XXE) Vulnerability in Apache POI's XLSX2CSV Example mailing-list
- 92100 vdb-entry
- 1037741 vdb-entry
- [users] 20160722 [CVE-2016-5000] XML External Entity (XXE) Vulnerability in Apache POI's XLSX2CSV Example mailing-list