CVE-2018-19277: XXE Vulnerability
securityScan() in PHPOffice PhpSpreadsheet through 1.5.0 allows a bypass of protection mechanisms for XXE via UTF-7 encoding in a .xlsx file
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/phpoffice/phpexcelto a version that resolves this vulnerability.Fixed in 1.8.2 - Upgrade
Upgrade
composer/phpoffice/phpspreadsheetto a version that resolves this vulnerability.Fixed in 1.5.1 - Upgrade
Upgrade
composer/phpoffice/phpexcelto a version that resolves this vulnerability.Fixed in 1.8.0
Event History
Frequently Asked Questions
What is the severity of CVE-2018-19277?
CVE-2018-19277 is considered a medium severity vulnerability due to its potential for bypassing protection mechanisms.
How do I fix CVE-2018-19277?
To fix CVE-2018-19277, you should upgrade to PhpSpreadsheet version 1.5.1 or higher.
What does CVE-2018-19277 affect?
CVE-2018-19277 affects PhpSpreadsheet versions up to and including 1.5.0.
What type of vulnerability is CVE-2018-19277?
CVE-2018-19277 is an XML External Entity (XXE) vulnerability.
Can CVE-2018-19277 be exploited through .xlsx files?
Yes, CVE-2018-19277 can be exploited by using specially crafted .xlsx files containing UTF-7 encoded data.