GHSA-XCRG-29H7-H4CJ高危已审查

XXE in PHPSpreadsheet due to encoding issue

OSV 1.4.0 · github-reviewed · 修改于 2025-03-07 02:08

发布时间

2019-11-20 09:38

GitHub 审查时间

2019-11-19 11:40

NVD 发布时间

2018-11-14 19:29

源文件

advisories/github-reviewed/2019/11/GHSA-xcrg-29h7-h4cj/GHSA-xcrg-29h7-h4cj.json

公告说明

securityScan() in PHPOffice PhpSpreadsheet through 1.5.0 allows a bypass of protection mechanisms for XXE via UTF-7 encoding in a .xlsx file

受影响的软件包

Packagist

phpoffice/phpspreadsheet

ECOSYSTEM

引入0修复1.5.1

Packagist

标识信息

别名 / CVE

CVE-2018-19277

CWE

CWE-91

软件生态

Packagist

扩展资料

暂无扩展资料。

CVSS 评分

CVSS_V3

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

原始 OSV JSON

{
  "id": "GHSA-xcrg-29h7-h4cj",
  "aliases": [
    "CVE-2018-19277"
  ],
  "details": "securityScan() in PHPOffice PhpSpreadsheet through 1.5.0 allows a bypass of protection mechanisms for XXE via UTF-7 encoding in a .xlsx file",
  "summary": "XXE in PHPSpreadsheet due to encoding issue",
  "affected": [
    {
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.5.1"
            }
          ]
        }
      ],
      "package": {
        "name": "phpoffice/phpspreadsheet",
        "ecosystem": "Packagist"
      }
    },
    {
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.8.2"
            }
          ]
        }
      ],
      "package": {
        "name": "phpoffice/phpexcel",
        "ecosystem": "Packagist"
      }
    }
  ],
  "modified": "2025-03-06T18:08:03Z",
  "severity": [
    {
      "type": "CVSS_V3",
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
    }
  ],
  "published": "2019-11-20T01:38:52Z",
  "references": [
    {
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-19277",
      "type": "ADVISORY"
    },
    {
      "url": "https://github.com/MewesK/TwigSpreadsheetBundle/issues/18",
      "type": "WEB"
    },
    {
      "url": "https://github.com/PHPOffice/PhpSpreadsheet/issues/771",
      "type": "WEB"
    },
    {
      "url": "https://github.com/PHPOffice/PhpSpreadsheet/pull/780",
      "type": "WEB"
    },
    {
      "url": "https://github.com/PHPOffice/PHPExcel/commit/2b601574975acfb9d4378a788ed5f2b747958095",
      "type": "WEB"
    },
    {
      "url": "https://github.com/PHPOffice/PhpSpreadsheet/commit/0f8f071e24ee8b114d894ac172f77dc250e5bfa4",
      "type": "WEB"
    },
    {
      "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/phpoffice/phpspreadsheet/CVE-2018-19277.yaml",
      "type": "WEB"
    },
    {
      "url": "https://github.com/PHPOffice/PHPExcel/commits/1.8.2",
      "type": "WEB"
    },
    {
      "url": "https://github.com/PHPOffice/PhpSpreadsheet",
      "type": "PACKAGE"
    },
    {
      "url": "https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/1.5.1",
      "type": "WEB"
    },
    {
      "url": "https://www.bishopfox.com/news/2018/11/phpoffice-versions",
      "type": "WEB"
    },
    {
      "url": "https://www.drupal.org/sa-contrib-2021-043",
      "type": "WEB"
    }
  ],
  "schema_version": "1.4.0",
  "database_specific": {
    "cwe_ids": [
      "CWE-91"
    ],
    "severity": "HIGH",
    "github_reviewed": true,
    "nvd_published_at": "2018-11-14T11:29:00Z",
    "github_reviewed_at": "2019-11-19T03:40:52Z"
  }
}