CVE-2019-12415: Apache Poi

Medium severity, CVSS 5.5. EPSS: 1% chance of exploitation in the next 30 days.

In Apache POI up to 4.1.0, when using the tool XSSFExportToXml to convert user-provided Microsoft Excel documents, a specially crafted document can allow an attacker to read files from the local filesystem or from internal network resources via XML External Entity (XXE) Processing.

Affected products

  • Apache Poi: up to and including 4.1.0
  • Oracle Application Testing Suite: version 12.5.0.3 only; version 13.1.0.1 only; version 13.2.0.1 only; version 13.3.0.1 only
  • Oracle Banking Enterprise Originations: version 2.7.0 only; version 2.8.0 only
  • Oracle Banking Enterprise Product Manufacturing: version 2.7.0 only; version 2.8.0 only
  • Oracle Banking Payments: version 14.0.0 only; version 14.1.0 only
  • Oracle Banking Platform: version 2.4.0 only; version 2.4.1 only; version 2.5.0 only; version 2.6.0 only; version 2.6.1 only; version 2.6.2 only; …
  • Oracle Big Data Discovery: version 1.6 only
  • Oracle Communications Diameter Signaling Router Idih:: version 8.0.0 only; version 8.2.2 only
  • Oracle Endeca Information Discovery Studio: version 3.2.0 only
  • Oracle Enterprise Manager Base Platform: version 12.1.0.5 only; version 13.3.0.0 only; version 13.4.0.0 only
  • Oracle Enterprise Repository: version 12.1.3.0.0 only
  • Oracle Financial Services Analytical Applications Infrastructure: from 8.0.6, up to and including 8.0.9
  • Oracle Financial Services Market Risk Measurement And Management: version 8.0.6 only; version 8.0.8 only
  • Oracle Flexcube Private Banking: version 12.0.0 only; version 12.1.0 only
  • Oracle Hyperion Infrastructure Technology: version 11.1.2.4 only
  • Oracle Instantis Enterprisetrack: version 17.1 only; version 17.2 only; version 17.3 only
  • Oracle Insurance Policy Administration j2ee: version 11.0.2 only; version 11.1.0 only; version 11.2.0 only
  • Oracle Insurance Rules Palette: version 10.2.0 only; version 10.2.4 only; version 11.0.2 only; version 11.1.0 only; version 11.2.0 only
  • Oracle Jdeveloper: version 12.2.1.4.0 only
  • Oracle PeopleSoft Enterprise PeopleTools: version 8.57 only; version 8.58 only; version 8.59 only
  • Oracle Primavera Gateway: version 17.12.6 only; version 18.8.8.1 only
  • Oracle Primavera Unifier: from 17.7, up to and including 17.12; version 16.1 only; version 16.2 only; version 18.8 only; version 19.12 only
  • Oracle Retail Clearance Optimization Engine: version 14.0 only
  • Oracle Retail Order Broker: version 15.0 only; version 16.0 only
  • Oracle Retail Predictive Application Server: version 15.0.3 only; version 16.0.3 only
  • and 2 more

Published 2019-10-23. Last modified 2026-06-17.