CVE-2016-5000: XEE
The XLSX2CSV example in Apache POI before 3.14 allows remote attackers to read arbitrary files via a crafted OpenXML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2016-5000?
CVE-2016-5000 has been assigned a CVSS score indicating a medium severity due to its potential for data exposure.
How does CVE-2016-5000 allow exploitation?
CVE-2016-5000 allows exploitation through crafted OpenXML documents that leverage external entity declarations to read arbitrary files.
What software versions are affected by CVE-2016-5000?
CVE-2016-5000 affects Apache POI versions prior to 3.14, specifically up to version 3.13.
How can I mitigate the risks associated with CVE-2016-5000?
To mitigate CVE-2016-5000, upgrade Apache POI to version 3.14 or later to eliminate the vulnerability.
Are there specific file types that CVE-2016-5000 can exploit?
CVE-2016-5000 can exploit OpenXML document files, which may contain vulnerable external entity declarations.