-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
JavaJava| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.apache.poi:poi | maven | < 3.10.1 | 3.10.1 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from insecure XML parsing configurations in OPC SAX handlers. The patch shows replacement of direct SAXReader usage with SAXHelper which enforces secure processing (disabling DTDs, limiting entities). The original functions used vanilla SAXReader without FEATURE_SECURE_PROCESSING or entity expansion limits, making them susceptible to XXE. The affected methods directly handle document parsing from untrusted inputs, and their pre-patch implementations lacked critical security settings.
Ongoing coverage of React2Shell