Vulnerabilities > CVE-2022-23640 - XML Entity Expansion vulnerability in Excel Streaming Reader Project Excel Streaming Reader

CVSS 9.8 - CRITICAL

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

HIGH

Integrity impact

HIGH

Availability impact

HIGH

network

low complexity

excel-streaming-reader-project

CWE-776

critical

NVD

Published: 2022-03-02

Updated: 2024-11-21

Summary

Excel-Streaming-Reader is an easy-to-use implementation of a streaming Excel reader using Apache POI. Prior to xlsx-streamer 2.1.0, the XML parser that was used did apply all the necessary settings to prevent XML Entity Expansion issues. Upgrade to version 2.1.0 to receive a patch. There is no known workaround.

Vulnerable Configurations

Part	Description	Count
Application	Excel_Streaming_Reader_Project Excel Streaming Reader Project Excel Streaming Reader - Excel Streaming Reader Project Excel Streaming Reader 0.1 Excel Streaming Reader Project Excel Streaming Reader 0.2 Excel Streaming Reader Project Excel Streaming Reader 0.2.1 Excel Streaming Reader Project Excel Streaming Reader 0.2.2 Excel Streaming Reader Project Excel Streaming Reader 0.2.3 Excel Streaming Reader Project Excel Streaming Reader 0.2.4 Excel Streaming Reader Project Excel Streaming Reader 0.2.5 Excel Streaming Reader Project Excel Streaming Reader 0.2.6 Excel Streaming Reader Project Excel Streaming Reader 0.2.7 Excel Streaming Reader Project Excel Streaming Reader 0.2.8 Excel Streaming Reader Project Excel Streaming Reader 0.2.9 Excel Streaming Reader Project Excel Streaming Reader 0.2.10 Excel Streaming Reader Project Excel Streaming Reader 0.2.11 Excel Streaming Reader Project Excel Streaming Reader 0.2.12 Excel Streaming Reader Project Excel Streaming Reader 0.2.13 Excel Streaming Reader Project Excel Streaming Reader 1.0.0 Excel Streaming Reader Project Excel Streaming Reader 1.0.1 Excel Streaming Reader Project Excel Streaming Reader 1.0.2 Excel Streaming Reader Project Excel Streaming Reader 1.1.0 Excel Streaming Reader Project Excel Streaming Reader 1.2.0 Excel Streaming Reader Project Excel Streaming Reader 1.2.1 Excel Streaming Reader Project Excel Streaming Reader 2.0.0	23

Common Weakness Enumeration (CWE)

CWE-776 - Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

References