Vulnerabilities
Projects
Vulnerability Disclosure
About Us
Contact Us
Mend.io Vulnerability Database
What is a WS vulnerability ID?
What is an MSC vulnerability ID?
We found results for “”
CVE-2024-45292
Good to know:
Date: October 7, 2024
PHPSpreadsheet is a pure PHP library for reading and writing spreadsheet files. "\PhpOffice\PhpSpreadsheet\Writer\Html" does not sanitize "javascript:" URLs from hyperlink "href" attributes, resulting in a Cross-Site Scripting vulnerability. This issue has been addressed in release versions 1.29.2, 2.1.1, and 2.3.0. All users are advised to upgrade. There are no known workarounds for this vulnerability.
Language: PHP
Severity Score
Related Resources (7)
Severity Score
Weakness Type (CWE)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-79Top Fix
Upgrade Version
Upgrade to version phpoffice/phpspreadsheet - 2.3.0;phpoffice/phpspreadsheet - dev-dependabot/composer/dompdf/dompdf-3.1.0;phpoffice/phpspreadsheet - 3.7.0;phpoffice/phpspreadsheet - dev-dependabot/composer/symfony/process-6.4.14;phpoffice/phpspreadsheet - 2.1.1;phpoffice/phpspreadsheet - dev-release390;phpoffice/phpspreadsheet - dev-dependabot/composer/squizlabs/php_codesniffer-3.11.1;phpoffice/phpspreadsheet - dev-dependabot/composer/tecnickcom/tcpdf-6.7.7;phpoffice/phpspreadsheet - dev-gh-readonly-queue/master/pr-4151-8a57259141f7fb9afcb3981e4ae8cc6295449fcc;phpoffice/phpspreadsheet - dev-dependabot/composer/mitoteam/jpgraph-10.4.3;phpoffice/phpspreadsheet - 1.29.2;phpoffice/phpspreadsheet - dev-gh-readonly-queue/master/pr-3528-b4cd42d2b24da0c11797c5dea67f6e9b52f026c8;phpoffice/phpspreadsheet - dev-dependabot/composer/phpstan/phpstan-1.12.7;phpoffice/phpspreadsheet - dev-dependabot/composer/mpdf/mpdf-8.2.5;phpoffice/phpspreadsheet - 3.9.0;phpoffice/phpspreadsheet - dev-gh-readonly-queue/master/pr-3341-a936254e1093992bd5dd76e62551311d7b32eaa1;phpoffice/phpspreadsheet - dev-gh-readonly-queue/master/pr-4118-39fc51309181e82593b06e2fa8e45ef8333a0335;phpoffice/phpspreadsheet - dev-gh-readonly-queue/master/pr-4158-37bb1537c8d0972f0bd77f2140a34f48188c1cb2;phpoffice/phpspreadsheet - dev-gh-readonly-queue/master/pr-4189-d6a367688be092df1485af31ebf98fd2d8f39eee;phpoffice/phpspreadsheet - 3.3.0;phpoffice/phpspreadsheet - dev-gh-readonly-queue/master/pr-4148-6ac7d5ffce17c3c3728314fbd64d1ada83057fca;phpoffice/phpspreadsheet - 3.9.1;phpoffice/phpspreadsheet - dev-gh-readonly-queue/master/pr-4184-88c517f335f5ac6f08c4325da21702500ac91a21;phpoffice/phpspreadsheet - 3.4.0;phpoffice/phpspreadsheet - 3.5.0;phpoffice/phpspreadsheet - dev-gh-readonly-queue/master/pr-4142-c6ede15401bf25a50d8c5e9d1b180adf999487d6;phpoffice/phpspreadsheet - dev-dependabot/composer/friendsofphp/php-cs-fixer-3.65.0
CVSS v3.1
| Base Score: |
|
|---|---|
| Attack Vector (AV): | NETWORK |
| Attack Complexity (AC): | LOW |
| Privileges Required (PR): | LOW |
| User Interaction (UI): | REQUIRED |
| Scope (S): | CHANGED |
| Confidentiality (C): | LOW |
| Integrity (I): | LOW |
| Availability (A): | NONE |