Ecosyste.ms: Advisories

Security Advisories: MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXhjcmctMjloNy1oNGNq

XXE in PHPSpreadsheet due to encoding issue

securityScan() in PHPOffice PhpSpreadsheet through 1.5.0 allows a bypass of protection mechanisms for XXE via UTF-7 encoding in a .xlsx file

Permalink: https://github.com/advisories/GHSA-xcrg-29h7-h4cj
JSON: https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXhjcmctMjloNy1oNGNq
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: about 5 years ago
Updated: 3 months ago

CVSS Score: 8.8
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Identifiers: GHSA-xcrg-29h7-h4cj, CVE-2018-19277
References:

• https://nvd.nist.gov/vuln/detail/CVE-2018-19277
• https://github.com/MewesK/TwigSpreadsheetBundle/issues/18
• https://github.com/PHPOffice/PhpSpreadsheet/issues/771
• https://www.drupal.org/sa-contrib-2021-043
• https://github.com/PHPOffice/PhpSpreadsheet/pull/780
• https://github.com/PHPOffice/PhpSpreadsheet/commit/0f8f071e24ee8b114d894ac172f77dc250e5bfa4
• https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/1.5.1
• https://github.com/FriendsOfPHP/security-advisories/blob/master/phpoffice/phpspreadsheet/CVE-2018-19277.yaml
• https://www.bishopfox.com/news/2018/11/phpoffice-versions
• https://github.com/advisories/GHSA-xcrg-29h7-h4cj

Repository: https://github.com/MewesK/TwigSpreadsheetBundle
Blast Radius: 37.9

Affected Packages