CVE-2017-5992: XEE

Q: What is the severity of CVE-2017-5992?

CVE-2017-5992 is considered a moderate severity vulnerability due to its potential for XXE attacks.

Q: How do I fix CVE-2017-5992?

To fix CVE-2017-5992, upgrade Openpyxl to version 2.4.2 or later.

Q: What is the impact of CVE-2017-5992 on Openpyxl users?

CVE-2017-5992 allows attackers to exploit XML external entities through manipulated .xlsx files.

Q: Who is affected by CVE-2017-5992?

Users of Openpyxl version 2.4.1 are directly affected by CVE-2017-5992.

Q: What types of attacks can CVE-2017-5992 facilitate?

CVE-2017-5992 can facilitate XML External Entity (XXE) attacks, leading to data exfiltration or denial of service.

Published Feb 15, 2017

Updated

Openpyxl 2.4.1 resolves external entities by default, which allows remote attackers to conduct XXE attacks via a crafted .xlsx document.

Affected Software

2 affected componentsFixes available

Python Openpyxl=2.4.1

pip/openpyxl<=2.4.1

2.4.2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade pip/openpyxl to a version that resolves this vulnerability.
Fixed in 2.4.2
Upgrade
Upgrade openpyxl to a version that resolves this vulnerability.
Fixed in 2.4.1

Event History

Feb 15, 2017

CVE Published

via MITRE·07:00 PM

Data Sourced

via MITRE·07:00 PM

Description

Data Sourced

via NVD·07:59 PM

DescriptionSeverityWeaknessAffected Software

May 17, 2022

Advisory Published

via GitHub·02:58 AM

Frequently Asked Questions

What is the severity of CVE-2017-5992?

CVE-2017-5992 is considered a moderate severity vulnerability due to its potential for XXE attacks.

How do I fix CVE-2017-5992?

To fix CVE-2017-5992, upgrade Openpyxl to version 2.4.2 or later.

What is the impact of CVE-2017-5992 on Openpyxl users?

CVE-2017-5992 allows attackers to exploit XML external entities through manipulated .xlsx files.

Who is affected by CVE-2017-5992?