CVE-2020-7776

This affects the package phpoffice/phpspreadsheet from 0.0.0. The library is vulnerable to XSS when creating an html output from an excel file by adding a comment on any cell. The root cause of this issue is within the HTML writer where user comments are concatenated as part of link and this is returned as HTML. A fix for this issue is available on commit 0ed5b800be2136bcb8fa9c1bdf59abc957a98845/master branch.
Configurations

Configuration 1 (hide)

cpe:2.3:a:phpoffice:phpspreadsheet:*:*:*:*:*:*:*:*

History

04 Sep 2024, 17:45

Type Values Removed Values Added
First Time Phpoffice
Phpoffice phpspreadsheet
CPE cpe:2.3:a:phpspreadsheet_project:phpspreadsheet:*:*:*:*:*:*:*:* cpe:2.3:a:phpoffice:phpspreadsheet:*:*:*:*:*:*:*:*

Information

Published : 2020-12-09 17:15

Updated : 2024-09-04 17:45


NVD link : CVE-2020-7776

Mitre link : CVE-2020-7776

CVE.ORG link : CVE-2020-7776


JSON object : View

Products Affected

phpoffice

  • phpspreadsheet
CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')