Vulnerabilities
Projects
Vulnerability Disclosure
About Us
Contact Us
Mend.io Vulnerability Database
What is a WS vulnerability ID?
What is an MSC vulnerability ID?
We found results for “”
CVE-2024-45060
Good to know:
Date: October 7, 2024
PHPSpreadsheet is a pure PHP library for reading and writing spreadsheet files. One of the sample scripts in PhpSpreadsheet is susceptible to a cross-site scripting (XSS) vulnerability due to improper handling of input where a number is expected leading to formula injection. The code in in "45_Quadratic_equation_solver.php" concatenates the user supplied parameters directly into spreadsheet formulas. This allows an attacker to take control over the formula and output unsanitized data into the page, resulting in JavaScript execution. This issue has been addressed in release versions 1.29.2, 2.1.1, and 2.3.0. All users are advised to upgrade. There are no known workarounds for this vulnerability.
Language: PHP
Severity Score
Related Resources (8)
Severity Score
Weakness Type (CWE)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-79Top Fix
Upgrade Version
Upgrade to version phpoffice/phpspreadsheet - 3.7.0;phpoffice/phpspreadsheet - dev-release390;phpoffice/phpspreadsheet - 1.29.2;phpoffice/phpspreadsheet - 2.1.1;phpoffice/phpspreadsheet - 3.9.0;phpoffice/phpspreadsheet - 2.3.0;phpoffice/phpspreadsheet - dev-gh-readonly-queue/master/pr-3528-b4cd42d2b24da0c11797c5dea67f6e9b52f026c8;phpoffice/phpspreadsheet - dev-dependabot/composer/symfony/process-6.4.14;phpoffice/phpspreadsheet - 3.4.0;phpoffice/phpspreadsheet - dev-dependabot/composer/mpdf/mpdf-8.2.5;phpoffice/phpspreadsheet - dev-dependabot/composer/squizlabs/php_codesniffer-3.11.1;phpoffice/phpspreadsheet - dev-gh-readonly-queue/master/pr-4151-8a57259141f7fb9afcb3981e4ae8cc6295449fcc;phpoffice/phpspreadsheet - dev-gh-readonly-queue/master/pr-4189-d6a367688be092df1485af31ebf98fd2d8f39eee;phpoffice/phpspreadsheet - dev-dependabot/composer/dompdf/dompdf-3.1.0;phpoffice/phpspreadsheet - dev-dependabot/composer/mitoteam/jpgraph-10.4.3;phpoffice/phpspreadsheet - dev-dependabot/composer/phpstan/phpstan-1.12.7;phpoffice/phpspreadsheet - dev-gh-readonly-queue/master/pr-3341-a936254e1093992bd5dd76e62551311d7b32eaa1;phpoffice/phpspreadsheet - 3.9.1;phpoffice/phpspreadsheet - dev-gh-readonly-queue/master/pr-4118-39fc51309181e82593b06e2fa8e45ef8333a0335;phpoffice/phpspreadsheet - dev-gh-readonly-queue/master/pr-4184-88c517f335f5ac6f08c4325da21702500ac91a21;phpoffice/phpspreadsheet - 3.3.0;phpoffice/phpspreadsheet - dev-gh-readonly-queue/master/pr-4142-c6ede15401bf25a50d8c5e9d1b180adf999487d6;phpoffice/phpspreadsheet - 3.5.0;phpoffice/phpspreadsheet - dev-dependabot/composer/tecnickcom/tcpdf-6.7.7;phpoffice/phpspreadsheet - dev-dependabot/composer/friendsofphp/php-cs-fixer-3.65.0;phpoffice/phpspreadsheet - dev-gh-readonly-queue/master/pr-4158-37bb1537c8d0972f0bd77f2140a34f48188c1cb2;phpoffice/phpspreadsheet - dev-gh-readonly-queue/master/pr-4148-6ac7d5ffce17c3c3728314fbd64d1ada83057fca
CVSS v3.1
| Base Score: |
|
|---|---|
| Attack Vector (AV): | NETWORK |
| Attack Complexity (AC): | LOW |
| Privileges Required (PR): | NONE |
| User Interaction (UI): | REQUIRED |
| Scope (S): | UNCHANGED |
| Confidentiality (C): | LOW |
| Integrity (I): | HIGH |
| Availability (A): | NONE |