← Back

CVE-2024-45048

nvd nist
Published: Aug 28, 2024Modified: Sep 4, 2024

JSON object

Loading...
6.5
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Exploitability: 2.8 / Impact: 3.6
Source: NVD

Description

PHPSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Affected versions are subject to a bypassing of a filter which allows for an XXE-attack. This in turn allows attacker to obtain contents of local files, even if error reporting is muted. This vulnerability has been addressed in release version 2.2.1. All users are advised to upgrade. There are no known workarounds for this vulnerability.

Affected (2)

Phpoffice
1 product
Phpspreadsheet
Configuration A
2 vulnerable
Vulnerable SoftwareAffected Versions
Phpoffice
Phpspreadsheet
Before 1.29.1
Phpspreadsheet
From 2.0.0 to 2.2.1

Related CWEs

CWE-611
Improper Restriction of XML External Entity Reference
The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.

References (2)

Source: security-advisories@github.com
Patch
Source: security-advisories@github.com
ExploitThird Party Advisory

Timeline

No history available yet.