CVE-2016-5000

MEDIUM

Apache POI < 3.14 - XML External Entity Injection via XLSX2CSV Example

Title source: llm
STIX 2.1

Description

The XLSX2CSV example in Apache POI before 3.14 allows remote attackers to read arbitrary files via a crafted OpenXML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

References (6)

Core 6
Core References
Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq
http://www.securityfocus.com/archive/1/538981/100/0/threaded
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/92100
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id/1037741
Mailing List mailing-list x_refsource_mlist
https://lists.apache.org/list.html?user%40poi.apache.org
Various Sources x_refsource_confirm
http://www-01.ibm.com/support/docview.wss?uid=swg21996759

Scores

CVSS v3 5.5
EPSS 0.0033
EPSS Percentile 56.1%
Attack Vector LOCAL
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Details

CWE
CWE-611
Status published
Products (2)
apache/poi < 3.13
org.apache.poi/poi-examples 0 - 3.14Maven
Published Aug 05, 2016
Tracked Since Feb 18, 2026