CVE-2024-56412

  1. Yack CVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-56412

5.4 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.3 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

P

hpSpreadsheet is a PHP library for reading and writing spreadsheet files. Versions prior to 3.7.0, 2.3.5, 2.1.6, and 1.29.7 are vulnerable to bypass of the cross-site scripting sanitizer using the javascript protocol and special characters. An attacker can use special characters, so that the library processes the javascript protocol with special characters and generates an HTML link. Versions 3.7.0, 2.3.5, 2.1.6, and 1.29.7 contain a patch for the issue.

References
Link Resource
https://github.com/PHPOffice/PhpSpreadsheet/commit/45052f88e04c735d56457a8ffcdc40b2635a028e Patch
https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-q9jv-mm3r-j47r Exploit Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:phpoffice:phpspreadsheet:*:*:*:*:*:*:*:*
cpe:2.3:a:phpoffice:phpspreadsheet:*:*:*:*:*:*:*:*
cpe:2.3:a:phpoffice:phpspreadsheet:*:*:*:*:*:*:*:*
cpe:2.3:a:phpoffice:phpspreadsheet:*:*:*:*:*:*:*:*
History

06 Mar 2025, 14:07

Type Values Removed Values Added
References () https://github.com/PHPOffice/PhpSpreadsheet/commit/45052f88e04c735d56457a8ffcdc40b2635a028e - () https://github.com/PHPOffice/PhpSpreadsheet/commit/45052f88e04c735d56457a8ffcdc40b2635a028e - Patch
References () https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-q9jv-mm3r-j47r - () https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-q9jv-mm3r-j47r - Exploit, Vendor Advisory
First Time Phpoffice
Phpoffice phpspreadsheet
CPE cpe:2.3:a:phpoffice:phpspreadsheet:*:*:*:*:*:*:*:*
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.4
Summary
  • (es) PhpSpreadsheet es una librería PHP para leer y escribir archivos de hojas de cálculo. Las versiones anteriores a 3.7.0, 2.3.5, 2.1.6 y 1.29.7 son vulnerables a la omisión del desinfectado de cross site scripting mediante el protocolo JavaScript y caracteres especiales. Un atacante puede utilizar caracteres especiales, de modo que la librería procese el protocolo JavaScript con caracteres especiales y genere un enlace HTML. Las versiones 3.7.0, 2.3.5, 2.1.6 y 1.29.7 contienen un parche para el problema.

03 Jan 2025, 18:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-01-03 18:15

Updated : 2025-03-06 14:07

NVD link : CVE-2024-56412

Mitre link : CVE-2024-56412

CVE.ORG link : CVE-2024-56412

JSON object : View

Products Affected

phpoffice

CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')