Описание
Apache POI in versions prior to release 3.15 allows remote attackers to cause a denial of service (CPU consumption) via a specially crafted OOXML file, aka an XML Entity Expansion (XEE) attack.
Ссылки
- Vendor Advisory
- Vendor Advisory
Уязвимые конфигурации
Конфигурация 1Версия до 3.14 (включая)
cpe:2.3:a:apache:poi:*:*:*:*:*:*:*:*
EPSS
Процентиль: 92%
0.04595
Низкий
5.5 Medium
CVSS3
7.1 High
CVSS2
Дефекты
CWE-776
Связанные уязвимости
CVSS3: 5.5
ubuntu
больше 9 лет назад
Apache POI in versions prior to release 3.15 allows remote attackers to cause a denial of service (CPU consumption) via a specially crafted OOXML file, aka an XML Entity Expansion (XEE) attack.
CVSS3: 5.5
debian
больше 9 лет назад
Apache POI in versions prior to release 3.15 allows remote attackers t ...
CVSS3: 5.5
github
больше 4 лет назад
Improper Restriction of Recursive Entity References in DTDs in Apache POI
CVSS3: 5.5
altlinux
почти 9 лет назад
ALT-PU-2017-3666: package `apache-poi` update to version 3.15-alt1_1jpp8
EPSS
Процентиль: 92%
0.04595
Низкий
5.5 Medium
CVSS3
7.1 High
CVSS2
Дефекты
CWE-776