CVEvulnerability

CVE-2014-2054

7.5 HIGH Published 2014-06-04 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2014-06-04
Last modified
2026-06-17
Assigner
[email protected]
CVSS 2.0 ([email protected])
7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P

Description

PHPExcel before 1.8.0, as used in ownCloud Server before 5.0.15 and 6.0.x before 6.0.2, does not disable external entity loading in libxml, which allows remote attackers to read arbitrary files, cause a denial of service, or possibly have other impact via an XML External Entity (XXE) attack.

Affected configurations

• owncloud owncloud server 6.0.0 • owncloud owncloud server 6.0.1 • phpexcel project phpexcel (<= 1.7.9) • owncloud owncloud server (<= 5.0.14) • owncloud owncloud server 5.0.0 • owncloud owncloud server 5.0.1 • owncloud owncloud server 5.0.2 • owncloud owncloud server 5.0.3 • owncloud owncloud server 5.0.4 • owncloud owncloud server 5.0.5 • owncloud owncloud server 5.0.6 • owncloud owncloud server 5.0.7 • owncloud owncloud server 5.0.8 • owncloud owncloud server 5.0.9 • owncloud owncloud server 5.0.10 • owncloud owncloud server 5.0.11 • owncloud owncloud server 5.0.12 • owncloud owncloud server 5.0.13 • owncloud owncloud server 5.0.14

References