CVE-2024-23525
Published: 18 January 2024
The Spreadsheet::ParseXLSX package before 0.30 for Perl allows XXE attacks because it neglects to use the no_xxe option of XML::Twig.
Priority
Status
| Package | Release | Status |
|---|---|---|
|
libspreadsheet-parsexlsx-perl Launchpad, Ubuntu, Debian |
bionic |
Ignored
(end of standard support)
|
| focal |
Released
(0.27-2+deb10u1build0.20.04.1)
|
|
| jammy |
Released
(0.27-2.1+deb11u2build0.22.04.1)
|
|
| lunar |
Ignored
(end of life, was needs-triage)
|
|
| mantic |
Released
(0.27-3+deb12u2build0.23.10.1)
|
|
| noble |
Not vulnerable
(0.31-1)
|
|
| trusty |
Ignored
(end of standard support)
|
|
| upstream |
Needs triage
|
|
| xenial |
Ignored
(end of standard support)
|
Severity score breakdown
| Parameter | Value |
|---|---|
| Base score | 6.5 |
| Attack vector | Network |
| Attack complexity | Low |
| Privileges required | None |
| User interaction | Required |
| Scope | Unchanged |
| Confidentiality | High |
| Integrity impact | None |
| Availability impact | None |
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N |
References
- https://gist.github.com/phvietan/d1c95a88ab6e17047b0248d6bf9eac4a
- https://github.com/MichaelDaum/spreadsheet-parsexlsx/issues/10
- https://github.com/MichaelDaum/spreadsheet-parsexlsx/commit/1d55f90caf433c7442e5be21a1849af2b5522ffe (0.30)
- https://metacpan.org/release/NUDDLEGG/Spreadsheet-ParseXLSX-0.30/changes
- http://www.openwall.com/lists/oss-security/2024/01/18/4
- https://www.cve.org/CVERecord?id=CVE-2024-23525
- https://ubuntu.com/security/notices/USN-6769-1
- NVD
- Launchpad
- Debian