Vulnerability Description
PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. Versions prior to 3.7.0, 2.3.5, 2.1.6, and 1.29.7 have no sanitization in the `/vendor/phpoffice/phpspreadsheet/samples/Engineering/Convert-Online.php` file, which leads to the possibility of a cross-site scripting attack. Versions 3.7.0, 2.3.5, 2.1.6, and 1.29.7 contain a patch for the issue.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Phpoffice | Phpspreadsheet | < 1.29.7 |
Related Weaknesses (CWE)
References
- https://github.com/PHPOffice/PhpSpreadsheet/commit/700a80346be269af668914172bc6fPatch
- https://github.com/PHPOffice/PhpSpreadsheet/commit/9b9a55c7154daa7cd4095f618933c
- https://github.com/PHPOffice/PhpSpreadsheet/commit/a50ebfe118b3ae0ddaea1c48ac19d
- https://github.com/PHPOffice/PhpSpreadsheet/commit/b8fac55aa5cb7a3d514c7308378bb
- https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-x88g-h956-mExploitVendor Advisory
- https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-x88g-h956-mExploitVendor Advisory
FAQ
What is CVE-2024-56408?
CVE-2024-56408 is a vulnerability with a CVSS score of 5.4 (MEDIUM). PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. Versions prior to 3.7.0, 2.3.5, 2.1.6, and 1.29.7 have no sanitization in the `/vendor/phpoffice/phpspreadsheet/samples/Engin...
How severe is CVE-2024-56408?
CVE-2024-56408 has been rated MEDIUM with a CVSS base score of 5.4/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2024-56408?
Check the references section above for vendor advisories and patch information. Affected products include: Phpoffice Phpspreadsheet.