CVE-2022-23640: Improper Restriction of XML External Entity Reference in com.monitorjbl:xlsx-streamer

com.monitorjbl:xlsx-streamer Updated 02 Oct 2025

Summary

02/03/2022

Disclosed on

CVE-2022-23640

CVE

Yes i

Fix available

Critical

Severity

9.8

CVSS Score

CVE-2022-23640: Improper Restriction of XML External Entity Reference in com.monitorjbl:xlsx-streamer. Affects com.monitorjbl:xlsx-streamer versions < 2.1.0. Fixed in 2.1.0. How to fix ↓

Free scan

Check if this vulnerability affects your application

Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.

Check my app free

No signup required · Results in about 60 seconds

Upload your dependency manifest or SBOM

Drag & drop your file here or Browse

Java Javascript PHP Python Go Rust Ruby Dart C/C++ Elixir CycloneDX SPDX

Upload a supported dependency manifest or SBOM. No installation or source-code access required.

See supported files and SBOM formats

SBOM sbom.json · bom.json · bom.xml · *.spdx.json · *.cdx.json · *.cdx.xml

Java pom.xml · gradle.lockfile · buildscript-gradle.lockfile

Javascript package-lock.json · yarn.lock · pnpm-lock.yaml

PHP composer.lock

Python poetry.lock · requirements.txt · Pipfile.lock

Go go.mod

Rust Cargo.lock

Ruby Gemfile.lock

Dart pubspec.lock

C/C++ conan.lock

Elixir mix.lock

Enter your work email to receive your report link.

Verify your email to view the full report and start 30 days of continuous monitoring. No credit card required.

Background

The com.monitorjbl:xlsx-streamer package is a Maven package that provides functionality for streaming reading and writing of Excel files. It allows users to efficiently process large Excel files without loading the entire file into memory. This package is commonly used in Java applications that require Excel file manipulation.

Vulnerability Detail

The vulnerability identified as CVE-2022-23640 in com.monitorjbl:xlsx-streamer is due to an improper restriction of XML external entity reference. Prior to version 2.1.0, the XML parser used in the package did not apply all the necessary settings to prevent XML entity expansion issues. This vulnerability could be exploited by an attacker to read arbitrary files on the system or launch denial-of-service attacks. The severity of this vulnerability is rated as CRITICAL with a CVSS score of 9.8.

How To Fix

Minimum fixed version

2.1.0

This is the first release that contains the fix.

Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →

Workaround

There is no known workaround for this vulnerability. It is essential to upgrade to the fixed version to address the issue effectively.

Conclusion

The vulnerability in com.monitorjbl:xlsx-streamer (CVE-2022-23640) exposes the application to potential file read and denial-of-service attacks. To mitigate this vulnerability, it is crucial to upgrade to version 2.1.0 of the package. For further support on vulnerability remediation, contact DevNack.com.

See every vulnerability recorded for com.monitorjbl:xlsx-streamer →