Description
Vulnerable Library - poi-ooxml-3.17.jar
Apache POI - Java API To Access Microsoft Format Files
Library home page: http://www.apache.org/
Path to dependency file: /pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/org/apache/poi/poi-ooxml/3.17/poi-ooxml-3.17.jar
Found in HEAD commit: 70721f6922070277ed5694bdd08c68eeb0853ccf
Vulnerabilities
| Vulnerability | Severity |  CVSS |
Dependency | Type | Fixed in (poi-ooxml version) | Remediation Possible** | Reachability |
|---|---|---|---|---|---|---|---|
| CVE-2021-23926 |  Critical |
9.1 | xmlbeans-2.6.0.jar | Transitive | 4.0.0 | ✅ |
|
| CVE-2019-12415 |  Medium |
5.5 | poi-ooxml-3.17.jar | Direct | 4.1.1 | ✅ |
|
| CVE-2025-31672 | Medium |
6.5 | poi-ooxml-3.17.jar | Direct | org.apache.poi:poi-ooxml:5.4.0 | ✅ |
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
Details
CVE-2021-23926
Vulnerable Library - xmlbeans-2.6.0.jar
XmlBeans main jar
Library home page: http://xmlbeans.apache.org/
Path to dependency file: /pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/org/apache/xmlbeans/xmlbeans/2.6.0/xmlbeans-2.6.0.jar
Dependency Hierarchy:
- poi-ooxml-3.17.jar (Root Library)
- poi-ooxml-schemas-3.17.jar
- ❌ xmlbeans-2.6.0.jar (Vulnerable Library)
- poi-ooxml-schemas-3.17.jar
Found in HEAD commit: 70721f6922070277ed5694bdd08c68eeb0853ccf
Found in base branch: master
Reachability Analysis
This vulnerability is potentially reachable
org.spdx.spdxspreadsheet.AbstractSpreadsheet (Application)
-> org.apache.poi.ss.usermodel.WorkbookFactory (Extension)
-> org.apache.poi.openxml4j.opc.OPCPackage (Extension)
-> org.apache.xmlbeans.impl.values.JavaDoubleHolderEx (Extension)
...
-> org.apache.xmlbeans.impl.schema.BuiltinSchemaTypeSystem (Extension)
-> org.apache.xmlbeans.impl.schema.SchemaTypeLoaderBase (Extension)
-> ❌ org.apache.xmlbeans.impl.store.Locale (Vulnerable Component)
Vulnerability Details
The XML parsers used by XMLBeans up to version 2.6.0 did not set the properties needed to protect the user from malicious XML input. Vulnerabilities include possibilities for XML Entity Expansion attacks. Affects XMLBeans up to and including v2.6.0.
Publish Date: 2021-01-14
URL: CVE-2021-23926
CVSS 3 Score Details (9.1)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23926
Release Date: 2021-01-14
Fix Resolution (org.apache.xmlbeans:xmlbeans): 3.0.0
Direct dependency fix Resolution (org.apache.poi:poi-ooxml): 4.0.0
⛑️ Automatic Remediation will be attempted for this issue.
CVE-2019-12415
Vulnerable Library - poi-ooxml-3.17.jar
Apache POI - Java API To Access Microsoft Format Files
Library home page: http://www.apache.org/
Path to dependency file: /pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/org/apache/poi/poi-ooxml/3.17/poi-ooxml-3.17.jar
Dependency Hierarchy:
- ❌ poi-ooxml-3.17.jar (Vulnerable Library)
Found in HEAD commit: 70721f6922070277ed5694bdd08c68eeb0853ccf
Found in base branch: master
Reachability Analysis
This vulnerability is potentially reachable
org.spdx.spdxspreadsheet.AbstractSpreadsheet (Application)
-> org.apache.poi.ss.usermodel.WorkbookFactory (Extension)
-> org.apache.poi.xssf.usermodel.XSSFWorkbook (Extension)
-> org.apache.poi.xssf.model.StylesTable (Extension)
-> ❌ org.apache.poi.xssf.usermodel.XSSFBuiltinTableStyle (Vulnerable Component)
Vulnerability Details
In Apache POI up to 4.1.0, when using the tool XSSFExportToXml to convert user-provided Microsoft Excel documents, a specially crafted document can allow an attacker to read files from the local filesystem or from internal network resources via XML External Entity (XXE) Processing.
Publish Date: 2019-10-23
URL: CVE-2019-12415
CVSS 3 Score Details (5.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: Low
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: None
- Availability Impact: None
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-12415
Release Date: 2019-10-23
Fix Resolution: 4.1.1
⛑️ Automatic Remediation will be attempted for this issue.
CVE-2025-31672
Vulnerable Library - poi-ooxml-3.17.jar
Apache POI - Java API To Access Microsoft Format Files
Library home page: http://www.apache.org/
Path to dependency file: /pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/org/apache/poi/poi-ooxml/3.17/poi-ooxml-3.17.jar
Dependency Hierarchy:
- ❌ poi-ooxml-3.17.jar (Vulnerable Library)
Found in HEAD commit: 70721f6922070277ed5694bdd08c68eeb0853ccf
Found in base branch: master
Vulnerability Details
Improper Input Validation vulnerability in Apache POI. The issue affects the parsing of OOXML format files like xlsx,
docx and pptx. These file formats are basically zip files and it is possible for malicious users to add zip entries
with duplicate names (including the path) in the zip. In this case, products reading the affected file could read
different data because 1 of the zip entries with the duplicate name is selected over another but different products may
choose a different zip entry.
This issue affects Apache POI poi-ooxml before 5.4.0. poi-ooxml 5.4.0 has a check that throws an exception if zip
entries with duplicate file names are found in the input file.
Users are recommended to upgrade to version poi-ooxml 5.4.0, which fixes the issue.
Publish Date: 2025-04-09
URL: CVE-2025-31672
CVSS 3 Score Details (6.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: None
Suggested Fix
Type: Upgrade version
Origin: https://seclists.org/oss-sec/2025/q2/26
Release Date: 2025-04-07
Fix Resolution: org.apache.poi:poi-ooxml:5.4.0
⛑️ Automatic Remediation will be attempted for this issue.
⛑️Automatic Remediation will be attempted for this issue.