PHPSpreadsheet is a pure PHP library for reading and writing spreadsheet files. In affected versions `\PhpOffice\PhpSpreadsheet\Writer\Html` doesn't sanitize spreadsheet styling information such as font names, allowing an attacker to inject arbitrary JavaScript on the page. As a result an attacker may used a crafted spreadsheet to fully takeover a session of a user viewing spreadsheet files as HTML. This issue has been addressed in release version 2.1.0. All users are advised to upgrade. There are no known workarounds for this vulnerability.
References
| Link | Resource |
|---|---|
| https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-wgmf-q9vr-vww6 | Exploit Third Party Advisory |
| https://github.com/PHPOffice/PhpSpreadsheet/pull/3957 | Issue Tracking Patch |
| https://github.com/PHPOffice/PhpSpreadsheet/commit/f7cf378faed2e11cf4825bf8bafea4922ae44667 | Patch |
Configurations
Configuration 1 (hide)
|
History
04 Sep 2024, 17:32
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/PHPOffice/PhpSpreadsheet/commit/f7cf378faed2e11cf4825bf8bafea4922ae44667 - Patch | |
| References | () https://github.com/PHPOffice/PhpSpreadsheet/pull/3957 - Issue Tracking, Patch | |
| References | () https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-wgmf-q9vr-vww6 - Exploit, Third Party Advisory | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 5.4 |
| First Time |
Phpoffice
Phpoffice phpspreadsheet |
|
| CPE | cpe:2.3:a:phpoffice:phpspreadsheet:*:*:*:*:*:*:*:* | |
| CWE | CWE-79 |
28 Aug 2024, 21:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-08-28 21:15
Updated : 2024-09-04 17:32
NVD link : CVE-2024-45046
Mitre link : CVE-2024-45046
JSON object : View
Products Affected
phpoffice
- phpspreadsheet
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')