Log in Start free

Vulnerability · Published Jan 3, 2025 · Assigned by GitHub_M

CVE-2024-56408PhpSpreadsheet allows unauthorized reflected XSS in `Convert-Online.php` file

High 8.3

In plain English

A high-severity cross-site scripting in PhpSpreadsheet from PHPOffice. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 36% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)8.3High
Exploit odds (30 days)0.4%top 64.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. Versions prior to 3.7.0, 2.3.5, 2.1.6, and 1.29.7 have no sanitization in the `/vendor/phpoffice/phpspreadsheet/samples/Engineering/Convert-Online.php` file, which leads to the possibility of a cross-site scripting attack. Versions 3.7.0, 2.3.5, 2.1.6, and 1.29.7 contain a patch for the issue.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Packagistphpoffice/phpexcelno fix listedGHSA-x88g-h956-m5xg
Packagistphpoffice/phpspreadsheet3.7.0GHSA-x88g-h956-m5xg
Packagistphpoffice/phpspreadsheet1.29.7GHSA-x88g-h956-m5xg
Packagistphpoffice/phpspreadsheet2.1.6GHSA-x88g-h956-m5xg
Packagistphpoffice/phpspreadsheet2.3.5GHSA-x88g-h956-m5xg

Affected products (as reported)

VendorProductVersions
PHPOffice PhpSpreadsheet >= 3.0.0, < 3.7.0< 1.29.7>= 2.0.0, < 2.1.6>= 2.2.0, < 2.3.5

Weakness: CWE-79 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:L/SI:H/SA:L

References