Vulnerability Description
PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. Versions prior to 3.7.0, 2.3.5, 2.1.6, and 1.29.7 are vulnerable to unauthorized reflected cross-site scripting in the `Currency.php` file. Using the `/vendor/phpoffice/phpspreadsheet/samples/Wizards/NumberFormat/Currency.php` script, an attacker can perform a cross-site scripting attack. Versions 3.7.0, 2.3.5, 2.1.6, and 1.29.7 contain a patch for the issue.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Phpoffice | Phpspreadsheet | < 1.29.7 |
Related Weaknesses (CWE)
References
- https://github.com/PHPOffice/PhpSpreadsheet/commit/700a80346be269af668914172bc6fPatch
- https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-j2xg-cjcx-4ExploitVendor Advisory
- https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-j2xg-cjcx-4ExploitVendor Advisory
FAQ
What is CVE-2024-56409?
CVE-2024-56409 is a vulnerability with a CVSS score of 5.4 (MEDIUM). PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. Versions prior to 3.7.0, 2.3.5, 2.1.6, and 1.29.7 are vulnerable to unauthorized reflected cross-site scripting in the `Curre...
How severe is CVE-2024-56409?
CVE-2024-56409 has been rated MEDIUM with a CVSS base score of 5.4/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2024-56409?
Check the references section above for vendor advisories and patch information. Affected products include: Phpoffice Phpspreadsheet.