GitHub Advisoryadvisory · Packagist

GHSA-r87q-fj25-f8jf Cross-site Scripting vulnerability in SimpleXLSXEx::readThemeColors, SimpleXLSXEx::getColorValue and SimpleXLSX::toHTMLEx

MEDIUM Published 2024-12-23 Modified 2024-12-23 Official page ↗
Aliases
CVE-2024-56364
Ecosystem
Packagist
Packages
shuchkin/simplexlsx
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N
Weaknesses
CWE-79
Reviewed
2024-12-23

Affected packages

• Packagist shuchkin/simplexlsx: >= 1.0.12, < 1.1.13 → fixed in 1.1.13

Description

Impact When calling the extended toHTMLEx method, it is possible to execute arbitrary JavaScript code. Patches The supplied patch resolves this vulnerability for SimpleXLSX. Use 1.1.13 Workarounds Don't use data publication via toHTMLEx *** This vulnerability was discovered by Aleksey Solovev (Positive Technologies)

Related

Alias · CVE (1)

  • CVE-2024-56364 SimpleXLSX is software for parsing and retrieving data from Excel XLSx files. vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References