GitHub Advisoryadvisory · Packagist

GHSA-x6mh-rjwm-8ph7 Cross-site Scripting vulnerability in SimpleXLSXEx::readXfs and SimpeXLSX::toHTMLEx

MEDIUM Published 2024-12-12 Modified 2024-12-12 Official page ↗
Aliases
CVE-2024-55878
Ecosystem
Packagist
Packages
shuchkin/simplexlsx
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N
Weaknesses
CWE-79
Reviewed
2024-12-12

Affected packages

• Packagist shuchkin/simplexlsx: >= 1.0.12, < 1.1.12 → fixed in 1.1.12

Description

Impact When calling the extended toHTMLEx method, it is possible to execute arbitrary JavaScript code. Patches The supplied patch resolves this vulnerability for SimpleXLSX. Use 1.1.12 Workarounds Don't use direct publication via toHTMLEx *** This vulnerability was discovered by Aleksey Solovev (Positive Technologies)

Related

Alias · CVE (1)

  • CVE-2024-55878 SimpleXLSX is software for parsing and retrieving data from Excel XLSx files. vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References