jxls-poi-1.0.15.jar: 2 vulnerabilities (highest severity is: 9.1)

[mend-for-github-com]

Vulnerable Library - jxls-poi-1.0.15.jar

Path to dependency file: /pom.xml

Path to vulnerable library: /pom.xml

Found in HEAD commit: 60011ae7663cd65acf66505fdbadc815033eace6

Vulnerabilities

CVE	Severity	CVSS	Dependency	Type	Fixed in (jxls-poi version)	Remediation Possible**
CVE-2021-23926	Critical	9.1	xmlbeans-2.6.0.jar	Transitive	1.0.16	✅
CVE-2019-12415	Medium	5.5	poi-ooxml-3.17.jar	Transitive	2.9.0	✅

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2021-23926

Vulnerable Library - xmlbeans-2.6.0.jar

XmlBeans main jar

Library home page: http://xmlbeans.apache.org/

Path to dependency file: /pom.xml

Path to vulnerable library: /pom.xml

Dependency Hierarchy:

• jxls-poi-1.0.15.jar (Root Library)
  • poi-ooxml-3.17.jar
    • poi-ooxml-schemas-3.17.jar
      • ❌ xmlbeans-2.6.0.jar (Vulnerable Library)

Found in HEAD commit: 60011ae7663cd65acf66505fdbadc815033eace6

Found in base branch: main

Vulnerability Details

The XML parsers used by XMLBeans up to version 2.6.0 did not set the properties needed to protect the user from malicious XML input. Vulnerabilities include possibilities for XML Entity Expansion attacks. Affects XMLBeans up to and including v2.6.0.

Publish Date: 2021-01-14

URL: CVE-2021-23926

CVSS 3 Score Details (9.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23926

Release Date: 2021-01-14

Fix Resolution (org.apache.xmlbeans:xmlbeans): 3.0.0

Direct dependency fix Resolution (org.jxls:jxls-poi): 1.0.16

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2019-12415

Vulnerable Library - poi-ooxml-3.17.jar

Apache POI - Java API To Access Microsoft Format Files

Library home page: http://www.apache.org/

Path to dependency file: /pom.xml

Path to vulnerable library: /pom.xml

Dependency Hierarchy:

• jxls-poi-1.0.15.jar (Root Library)
  • ❌ poi-ooxml-3.17.jar (Vulnerable Library)

Found in HEAD commit: 60011ae7663cd65acf66505fdbadc815033eace6

Found in base branch: main

Vulnerability Details

In Apache POI up to 4.1.0, when using the tool XSSFExportToXml to convert user-provided Microsoft Excel documents, a specially crafted document can allow an attacker to read files from the local filesystem or from internal network resources via XML External Entity (XXE) Processing.

Publish Date: 2019-10-23

URL: CVE-2019-12415

CVSS 3 Score Details (5.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Local
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: None
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-12415

Release Date: 2019-10-23

Fix Resolution (org.apache.poi:poi-ooxml): 4.1.1

Direct dependency fix Resolution (org.jxls:jxls-poi): 2.9.0

⛑️ Automatic Remediation will be attempted for this issue.

---

⛑️Automatic Remediation will be attempted for this issue.