CVE-2014-2054

PHPExcel before 1.8.0, as used in ownCloud Server before 5.0.15 and 6.0.x before 6.0.2, does not disable external entity loading in libxml, which allows remote attackers to read arbitrary files, cause a denial of service, or possibly have other impact via an XML External Entity (XXE) attack.

CVSS v2.0 7.5 HIGH

7.5^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://owncloud.org/about/security/advisories/oC-SA-2014-006/	Vendor Advisory
https://github.com/PHPOffice/PHPExcel/blob/develop/changelog.txt

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:owncloud:owncloud:6.0.0:::::::*
	cpe:2.3:a:owncloud:owncloud:6.0.1:::::::*
	cpe:2.3:a:phpexcel_project:phpexcel::::::::

Configuration 2 (hide)

OR	cpe:2.3:a:owncloud:owncloud::a::::::*
	cpe:2.3:a:owncloud:owncloud:5.0.0:::::::*
	cpe:2.3:a:owncloud:owncloud:5.0.1:::::::*
	cpe:2.3:a:owncloud:owncloud:5.0.2:::::::*
	cpe:2.3:a:owncloud:owncloud:5.0.3:::::::*
	cpe:2.3:a:owncloud:owncloud:5.0.4:::::::*
	cpe:2.3:a:owncloud:owncloud:5.0.5:::::::*
	cpe:2.3:a:owncloud:owncloud:5.0.6:::::::*
	cpe:2.3:a:owncloud:owncloud:5.0.7:::::::*
	cpe:2.3:a:owncloud:owncloud:5.0.8:::::::*
	cpe:2.3:a:owncloud:owncloud:5.0.9:::::::*
	cpe:2.3:a:owncloud:owncloud:5.0.10:::::::*
	cpe:2.3:a:owncloud:owncloud:5.0.11:::::::*
	cpe:2.3:a:owncloud:owncloud:5.0.12:::::::*
	cpe:2.3:a:owncloud:owncloud:5.0.13:::::::*
	cpe:2.3:a:owncloud:owncloud:5.0.14:::::::*
	cpe:2.3:a:phpexcel_project:phpexcel::::::::

History

No history.

Information

Published : 2014-06-04 14:55

Updated : 2024-02-28 12:20

NVD link : CVE-2014-2054

Mitre link : CVE-2014-2054

CVE.ORG link : CVE-2014-2054

JSON object : View

Products Affected

phpexcel_project

phpexcel

owncloud

owncloud

CWE

NVD-CWE-Other

{"id": "CVE-2014-2054", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2014-06-04T14:55:03.983", "references": [{"url": "http://owncloud.org/about/security/advisories/oC-SA-2014-006/", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://github.com/PHPOffice/PHPExcel/blob/develop/changelog.txt", "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "descriptions": [{"lang": "en", "value": "PHPExcel before 1.8.0, as used in ownCloud Server before 5.0.15 and 6.0.x before 6.0.2, does not disable external entity loading in libxml, which allows remote attackers to read arbitrary files, cause a denial of service, or possibly have other impact via an XML External Entity (XXE) attack."}, {"lang": "es", "value": "PHPExcel anterior a 1.8.0, utilizado en ownCloud Server anterior a 5.0.15 y 6.0.x anterior a 6.0.2, no deshabilita la carga de entidades externas en libxml, lo que permite a atacantes remotos leer archivos arbitrarios, causar una denegaci\u00f3n de servicio o posiblemente tener otro impacto a trav\u00e9s de un ataque de entidad externa XML (XXE)."}], "lastModified": "2014-06-04T18:34:17.347", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:owncloud:owncloud:6.0.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3A499C18-61F0-486C-99E5-F6DD74EE5521"}, {"criteria": "cpe:2.3:a:owncloud:owncloud:6.0.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "237F18EA-1A9B-4DE6-B604-12EB651F5F0F"}, {"criteria": "cpe:2.3:a:phpexcel_project:phpexcel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3F54EA98-9036-41FD-B69C-8B2FA7D07E3B", "versionEndIncluding": "1.7.9"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:owncloud:owncloud:*:a:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CF8A525D-F052-449B-AFD8-DC6A956D30D9", "versionEndIncluding": "5.0.14"}, {"criteria": "cpe:2.3:a:owncloud:owncloud:5.0.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DF826F2B-83E1-4E64-A56C-B564028EBD6A"}, {"criteria": "cpe:2.3:a:owncloud:owncloud:5.0.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "22A19441-2041-45DC-9F59-783C9B1FF9D5"}, {"criteria": "cpe:2.3:a:owncloud:owncloud:5.0.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "43448288-B129-4210-9680-55836869F09F"}, {"criteria": "cpe:2.3:a:owncloud:owncloud:5.0.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "78639CDB-3763-4E71-B4F9-E51E5A261A16"}, {"criteria": "cpe:2.3:a:owncloud:owncloud:5.0.4:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8DBE1CE3-7A8D-4C97-8066-F59C346A0494"}, {"criteria": "cpe:2.3:a:owncloud:owncloud:5.0.5:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0F97DF5D-DC0E-43FB-B0D2-4AA8C2A5413D"}, {"criteria": "cpe:2.3:a:owncloud:owncloud:5.0.6:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "55475558-53CA-4764-9A70-1355D5759CFA"}, {"criteria": "cpe:2.3:a:owncloud:owncloud:5.0.7:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2DC3BCEC-9685-4899-91B6-1889FAB235C0"}, {"criteria": "cpe:2.3:a:owncloud:owncloud:5.0.8:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D4055273-FBA3-46A7-9B0B-0A5A8BB2E0AB"}, {"criteria": "cpe:2.3:a:owncloud:owncloud:5.0.9:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "56985A58-4F38-4192-AEC3-7953184206E7"}, {"criteria": "cpe:2.3:a:owncloud:owncloud:5.0.10:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D6510E0F-BA72-4591-8931-83974EFCDF0D"}, {"criteria": "cpe:2.3:a:owncloud:owncloud:5.0.11:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "14E553AC-B7F1-4692-8BC7-C59CE39C5CD5"}, {"criteria": "cpe:2.3:a:owncloud:owncloud:5.0.12:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3F1D79C4-2B24-4E55-8217-FDC00F22EC44"}, {"criteria": "cpe:2.3:a:owncloud:owncloud:5.0.13:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "16960810-E5B8-45EC-A54D-55941B1E728A"}, {"criteria": "cpe:2.3:a:owncloud:owncloud:5.0.14:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1DF9CAFD-F2E5-4AD4-BB65-D04A87E8E3B5"}, {"criteria": "cpe:2.3:a:phpexcel_project:phpexcel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3F54EA98-9036-41FD-B69C-8B2FA7D07E3B", "versionEndIncluding": "1.7.9"}], "operator": "OR"}]}], "evaluatorComment": "Per: http://cwe.mitre.org/data/definitions/611.html\n\n\"CWE-611: Improper Restriction of XML External Entity Reference ('XXE')\"", "sourceIdentifier": "cve@mitre.org"}