CVE-2019-12415 in Oracle Financial Services Revenue Management and Billinginfo

Summary

In Apache POI up to 4.1.0, when using the tool XSSFExportToXml to convert user-provided Microsoft Excel documents, a specially crafted document can allow an attacker to read files from the local filesystem or from internal network resources via XML External Entity (XXE) Processing.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Reservation

05/28/2019

Entries

VulDB provides additional information and datapoints for this CVE:

ID	Vulnerability	CWE	Exp	Cou	CVE
226516	Oracle Financial Services Revenue Management and Billing Infrastructure information disclosure	200	Not defined	Official fix	CVE-2019-12415
218824	Oracle AutoVue Installation information disclosure	200	Not defined	Official fix	CVE-2019-12415
211591	Oracle Insurance Insbridge Rating and Underwriting Framework Administrator IBFA information disclosure	200	Not defined	Official fix	CVE-2019-12415
184997	Oracle PeopleSoft Enterprise PeopleTools Apache POI information disclosure	200	Not defined	Official fix	CVE-2019-12415
184858	Oracle WebCenter Sites Apache POI information disclosure	200	Not defined	Official fix	CVE-2019-12415
179119	Oracle JDeveloper and ADF Apache POI information disclosure	200	Not defined	Official fix	CVE-2019-12415
168344	Oracle Hyperion Infrastructure Technology Common Security information disclosure	200	Not defined	Official fix	CVE-2019-12415
163346	Oracle Retail Order Broker Store Connect information disclosure	200	Not defined	Official fix	CVE-2019-12415
163060	Oracle Communications Diameter Signaling Router IDIH information disclosure	200	Not defined	Official fix	CVE-2019-12415
158339	Oracle Insurance Rules Palette Architecture xml external entity reference	611	Not defined	Official fix	CVE-2019-12415
158338	Oracle Insurance Policy Administration J2EE Architecture xml external entity reference	611	Not defined	Official fix	CVE-2019-12415
158317	Oracle WebCenter Portal Security xml external entity reference	611	Not defined	Official fix	CVE-2019-12415
158260	Oracle FLEXCUBE Private Banking Core xml external entity reference	611	Not defined	Official fix	CVE-2019-12415
158259	Oracle Banking Payments Core xml external entity reference	611	Not defined	Official fix	CVE-2019-12415
158225	Oracle Enterprise Manager Base Platform Application Service Level Mgmt xml external entity reference	611	Not defined	Official fix	CVE-2019-12415
153506	Oracle Big Data Discovery Studio xml external entity reference	611	Not defined	Official fix	CVE-2019-12415
153465	Oracle Financial Services Market Risk Measurement Infrastructure xml external entity reference	611	Not defined	Official fix	CVE-2019-12415
153464	Oracle Financial Services Analytical Applications Infrastructure xml external entity reference	611	Not defined	Official fix	CVE-2019-12415
153463	Oracle Banking Platform Core xml external entity reference	611	Not defined	Official fix	CVE-2019-12415
153462	Oracle Banking Enterprise Product Manufacturing Core xml external entity reference	611	Not defined	Official fix	CVE-2019-12415
153461	Oracle Banking Enterprise Originations Core xml external entity reference	611	Not defined	Official fix	CVE-2019-12415
153349	Oracle Instantis EnterpriseTrack Office Open document processor xml external entity reference	611	Not defined	Official fix	CVE-2019-12415
148958	Oracle Retail Predictive Application Server RPAS Fusion Client xml external entity reference	611	Not defined	Official fix	CVE-2019-12415
148957	Oracle Retail Predictive Application Server RPAS Fusion Client xml external entity reference	611	Not defined	Official fix	CVE-2019-12415
148956	Oracle Retail Clearance Optimization Engine General Application xml external entity reference	611	Not defined	Official fix	CVE-2019-12415
148854	Oracle Enterprise Repository Security xml external entity reference	611	Not defined	Official fix	CVE-2019-12415
148853	Oracle Endeca Information Discovery Studio xml external entity reference	611	Not defined	Official fix	CVE-2019-12415
148802	Oracle Application Testing Suite Load Testing for Web Apps xml external entity reference	611	Not defined	Official fix	CVE-2019-12415
148730	Oracle Primavera Unifier xml external entity reference	611	Not defined	Official fix	CVE-2019-12415
148729	Oracle Primavera Gateway Admin xml external entity reference	611	Not defined	Official fix	CVE-2019-12415
144093	Apache POI XSSFExportToXml xml external entity reference	611	Not defined	Not defined	CVE-2019-12415

Description

CPE

CWE

CVSS

Exploits

History

Diff

Relate

Threat Intelligence

API JSON

API XML

API CSV

Sources

◂ PreviousOverviewNext ▸

Want to stay up to date on a daily basis?

Enable the mail alert feature now!