CVE-2014-3529: XEE
IssueDescription:
It was found that Apache POI would resolve entities in OOXML documents. A remote attacker able to supply OOXML documents that are parsed by Apache POI could use this flaw to read files accessible to the user running the application server, and potentially perform more advanced XML External Entity (XXE) attacks.
Other sources
The OPC SAX setup in Apache POI before 3.10.1 allows remote attackers to read arbitrary files via an OpenXML file containing an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
Affected Software
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2014-3529?
CVE-2014-3529 is rated as a medium severity vulnerability.
How do I fix CVE-2014-3529?
To fix CVE-2014-3529, update Apache POI to version 3.10.1 or higher.
What impact does CVE-2014-3529 have?
CVE-2014-3529 allows a remote attacker to read files accessible to the user running the application server.
Which versions of Apache POI are affected by CVE-2014-3529?
Apache POI versions prior to 3.10.1 and those above 3.10 but below 3.11 are affected by CVE-2014-3529.
Is CVE-2014-3529 found in both maven and redhat packages?
Yes, CVE-2014-3529 affects both the maven package org.apache.poi:poi and the redhat package apache-poi-ooxml.