CVE-2020-7776

This affects the package phpoffice/phpspreadsheet from 0.0.0. The library is vulnerable to XSS when creating an html output from an excel file by adding a comment on any cell. The root cause of this issue is within the HTML writer where user comments are concatenated as part of link and this is returned as HTML. A fix for this issue is available on commit 0ed5b800be2136bcb8fa9c1bdf59abc957a98845/master branch.
Configurations

Configuration 1 (hide)

cpe:2.3:a:phpoffice:phpspreadsheet:*:*:*:*:*:*:*:*

History

21 Nov 2024, 05:37

Type Values Removed Values Added
CVSS v2 : 3.5
v3 : 6.4
v2 : 3.5
v3 : 7.1
References () https://github.com/PHPOffice/PhpSpreadsheet/blob/master/src/PhpSpreadsheet/Writer/Html.php%23L1792 - Broken Link () https://github.com/PHPOffice/PhpSpreadsheet/blob/master/src/PhpSpreadsheet/Writer/Html.php%23L1792 - Broken Link
References () https://github.com/PHPOffice/PhpSpreadsheet/commit/0ed5b800be2136bcb8fa9c1bdf59abc957a98845 - Patch, Third Party Advisory () https://github.com/PHPOffice/PhpSpreadsheet/commit/0ed5b800be2136bcb8fa9c1bdf59abc957a98845 - Patch, Third Party Advisory
References () https://snyk.io/vuln/SNYK-PHP-PHPOFFICEPHPSPREADSHEET-1048856 - Exploit, Third Party Advisory () https://snyk.io/vuln/SNYK-PHP-PHPOFFICEPHPSPREADSHEET-1048856 - Exploit, Third Party Advisory

04 Sep 2024, 17:45

Type Values Removed Values Added
First Time Phpoffice
Phpoffice phpspreadsheet
CPE cpe:2.3:a:phpspreadsheet_project:phpspreadsheet:*:*:*:*:*:*:*:* cpe:2.3:a:phpoffice:phpspreadsheet:*:*:*:*:*:*:*:*

Information

Published : 2020-12-09 17:15

Updated : 2024-11-21 05:37


NVD link : CVE-2020-7776

Mitre link : CVE-2020-7776

CVE.ORG link : CVE-2020-7776


JSON object : View

Products Affected

phpoffice

  • phpspreadsheet
CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')