Vulnerability Description
PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. Versions prior to 3.7.0, 2.3.5, 2.1.6, and 1.29.7 are vulnerable to unauthorized reflected cross-site scripting in the constructor of the `Downloader` class. Using the `/vendor/phpoffice/phpspreadsheet/samples/download.php` script, an attacker can perform a cross-site scripting attack. Versions 3.7.0, 2.3.5, 2.1.6, and 1.29.7 contain a patch for the issue.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Phpoffice | Phpspreadsheet | < 1.29.7 |
Related Weaknesses (CWE)
References
- https://github.com/PHPOffice/PhpSpreadsheet/commit/700a80346be269af668914172bc6fPatch
- https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-jmpx-686v-cExploitVendor Advisory
- https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-jmpx-686v-cExploitVendor Advisory
FAQ
What is CVE-2024-56365?
CVE-2024-56365 is a vulnerability with a CVSS score of 5.4 (MEDIUM). PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. Versions prior to 3.7.0, 2.3.5, 2.1.6, and 1.29.7 are vulnerable to unauthorized reflected cross-site scripting in the constr...
How severe is CVE-2024-56365?
CVE-2024-56365 has been rated MEDIUM with a CVSS base score of 5.4/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2024-56365?
Check the references section above for vendor advisories and patch information. Affected products include: Phpoffice Phpspreadsheet.