CVE-2016-5000

Published: Aug 5, 2016Modified: May 6, 2026

5.5

Vector

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Exploitability: 1.8 / Impact: 3.6

Source: NVD

Description

The XLSX2CSV example in Apache POI before 3.14 allows remote attackers to read arbitrary files via a crafted OpenXML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

Affected (1)

Products: Apache: Poi

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Apache Poi	Up to 3.13

Related CWEs

Improper Restriction of XML External Entity Reference

The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.

References (12)

http://www-01.ibm.com/support/docview.wss?uid=swg21996759

Source: secalert@redhat.com

http://www.securityfocus.com/archive/1/538981/100/0/threaded

Source: secalert@redhat.com

http://www.securityfocus.com/bid/92100

Source: secalert@redhat.com

http://www.securitytracker.com/id/1037741

Source: secalert@redhat.com

https://lists.apache.org/list.html?user%40poi.apache.org

Source: secalert@redhat.com

https://www.oracle.com/security-alerts/cpuoct2020.html

Source: secalert@redhat.com

http://www-01.ibm.com/support/docview.wss?uid=swg21996759

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/archive/1/538981/100/0/threaded

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/bid/92100

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securitytracker.com/id/1037741

Source: af854a3a-2127-422b-91ae-364da2661108

https://lists.apache.org/list.html?user%40poi.apache.org

Source: af854a3a-2127-422b-91ae-364da2661108

https://www.oracle.com/security-alerts/cpuoct2020.html

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.