XXE in PHPSpreadsheet due to encoding issue
securityScan() in PHPOffice PhpSpreadsheet through 1.5.0 allows a bypass of protection mechanisms for XXE via UTF-7 encoding in a .xlsx file
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2018-19277US | high8.8 | Exploit | ||
securityScan() in PHPOffice PhpSpreadsheet through 1.5.0 allows a bypass of protection mechanisms for XXE via UTF-7 encoding in a .xlsx file | ||||
02
references
External citations — patches, advisories, analysis.
- https://github.com/FriendsOfPHP/security-advisories/blob/master/phpoffice/phpspreadsheet/CVE-2018-19277.yamlWEB
- https://github.com/MewesK/TwigSpreadsheetBundle/issues/18WEB
- https://github.com/PHPOffice/PHPExcel/commit/2b601574975acfb9d4378a788ed5f2b747958095WEB
- https://github.com/PHPOffice/PHPExcel/commits/1.8.2WEB
- https://github.com/PHPOffice/PhpSpreadsheetPACKAGE
- https://github.com/PHPOffice/PhpSpreadsheet/commit/0f8f071e24ee8b114d894ac172f77dc250e5bfa4WEB
- https://github.com/PHPOffice/PhpSpreadsheet/issues/771WEB
- https://github.com/PHPOffice/PhpSpreadsheet/pull/780WEB
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan