CVE-2014-3529

medium · 4.3

The OPC SAX setup in Apache POI before 3.10.1 allows remote attackers to read arbitrary files via an OpenXML file containing an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

4.3

CVSS

12.8%

EPSS (exploit prob.)

96th

EPSS percentile

2014-09-04

Published

AV:N/AC:M/Au:N/C:P/I:N/A:N

Affected products

Vendor	Product	Affected versions
apache	poi	<= 3.10
apache	poi	0.1
apache	poi	0.2
apache	poi	0.3
apache	poi	0.4
apache	poi	0.5
apache	poi	0.6
apache	poi	0.7
apache	poi	0.10.0
apache	poi	0.11.0
apache	poi	0.12.0
apache	poi	0.13.0
apache	poi	0.14.0
apache	poi	1.0.0
apache	poi	1.0.1
apache	poi	1.0.2
apache	poi	1.1.0
apache	poi	1.2.0
apache	poi	1.5
apache	poi	1.5.1
apache	poi	1.7
apache	poi	1.8
apache	poi	1.10
apache	poi	2.0
apache	poi	2.0
apache	poi	2.0
apache	poi	2.0
apache	poi	2.0
apache	poi	2.0
apache	poi	2.5
apache	poi	2.5.1
apache	poi	3.0
apache	poi	3.0
apache	poi	3.0
apache	poi	3.0
apache	poi	3.0.1
apache	poi	3.0.2
apache	poi	3.0.2
apache	poi	3.0.2
apache	poi	3.1

Check a specific version with /api/v1/cve/match.

References

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2014-3529