Improper Input Validation in Apache POI
Moderate severity
GitHub Reviewed
Published
May 17, 2022
to the GitHub Advisory Database
•
Updated Apr 16, 2024
Package
Affected versions
< 3.10.1
= 3.11-beta1
Patched versions
3.10.1
3.11-beta2
Description
Published by the National Vulnerability Database
Sep 4, 2014
Published to the GitHub Advisory Database
May 17, 2022
Reviewed
Jul 7, 2022
Last updated
Apr 16, 2024
Credits
-
MarkLee131 Analyst
Apache POI before 3.10.1 and 3.11.x before 3.11-beta2 allows remote attackers to cause a denial of service (CPU consumption and crash) via a crafted OOXML file, aka an XML Entity Expansion (XEE) attack.
References