Skip to content

Improper Restriction of XML External Entity Reference in com.monitorjbl:xlsx-streamer

Critical
monitorjbl published GHSA-xvm2-9xvc-hx7f Mar 2, 2022

Package

maven com.monitorjbl:xlsx-streamer (Maven)

Affected versions

< 2.1.0

Patched versions

2.1.0

Description

Impact

Prior to xlsx-streamer 2.1.0, the XML parser that was used did not apply all the necessary settings to prevent XML Entity Expansion issues.

Patches

Upgrade to version 2.1.0.

Workarounds

No known workaround.

References

0749c7b

For more information

If you have any questions or comments about this advisory:

Severity

Critical

CVE ID

CVE-2022-23640

Weaknesses

Credits