MEDIUM
GHSA-28rm-rj57-qjpv
PHPExcel vulnerable to XXE attacks through libxml
Quick fix
GHSA-28rm-rj57-qjpv — phpoffice/phpexcel: upgrade to the fixed version with the command below.
composer require phpoffice/phpexcel:^1.8.0Details
PHPExcel before 1.8.0, as used in ownCloud Server before 5.0.15 and 6.0.x before 6.0.2, does not disable external entity loading in libxml, which allows remote attackers to read arbitrary files, cause a denial of service, or possibly have other impact via an XML External Entity (XXE) attack.
Are you affected?
Enter the version of the package you're using.
Affected packages
Packagist/phpoffice/phpexcel
Introduced in:
0Fixed in: 1.8.0Fix
composer require phpoffice/phpexcel:^1.8.0References
- https://nvd.nist.gov/vuln/detail/CVE-2014-2054[ADVISORY]
- https://github.com/PHPOffice/PHPExcel/commit/e04bf7ed091b0a72d028eacf26d770b485d4e897[WEB]
- https://github.com/PHPOffice/PHPExcel[PACKAGE]
- https://github.com/PHPOffice/PHPExcel/blob/2b601574975acfb9d4378a788ed5f2b747958095/changelog.txt#L120[WEB]
- https://github.com/PHPOffice/PHPExcel/blob/develop/changelog.txt[WEB]
- http://owncloud.org/about/security/advisories/oC-SA-2014-006[WEB]