CVE-2020-7776: XSS Vulnerability in HTML Writer
Cross-site scripting in phpoffice/phpspreadsheet
Other sources
This affects the package phpoffice/phpspreadsheet from 0.0.0. The library is vulnerable to XSS when creating an html output from an excel file by adding a comment on any cell. The root cause of this issue is within the HTML writer where user comments are concatenated as part of link and this is returned as HTML. A fix for this issue is available on commit 0ed5b800be2136bcb8fa9c1bdf59abc957a98845/master branch.
— NVD
This affects the package phpoffice/phpspreadsheet. The library is vulnerable to XSS when creating an html output from an excel file by adding a comment on any cell. The root cause of this issue is within the HTML writer where user comments are concatenated as part of link and this is returned as HTML.
— GitHub
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/phpoffice/phpspreadsheetto a version that resolves this vulnerability.Fixed in 1.16.0 - Upgrade
Upgrade
phpoffice/phpspreadsheetto a version that resolves this vulnerability.Patch 0ed5b800be2136bcb8fa9c1bdf59abc957a98845/master
Event History
Frequently Asked Questions
What is the severity of CVE-2020-7776?
The severity of CVE-2020-7776 is classified as medium due to its potential for cross-site scripting (XSS) attacks.
How do I fix CVE-2020-7776?
To fix CVE-2020-7776, upgrade the phpoffice/phpspreadsheet package to version 1.16.0 or later.
What type of vulnerability is CVE-2020-7776?
CVE-2020-7776 is a cross-site scripting (XSS) vulnerability found in the phpoffice/phpspreadsheet library.
In which versions of phpoffice/phpspreadsheet is CVE-2020-7776 present?
CVE-2020-7776 is present in phpoffice/phpspreadsheet versions prior to 1.16.0.
Who is affected by CVE-2020-7776?
Users of phpoffice/phpspreadsheet version 1.16.0 and below are affected by CVE-2020-7776.