shuchkin/simplexlsx · Security
Cross-site Scripting vulnerability in SimpleXLSXEx::readThemeColors, SimpleXLSXEx::getColorValue and SimpleXLSX::toHTMLEx
- GHSA ID
- GHSA-r87q-fj25-f8jf
- CVE ID
- CVE-2024-56364
- Severity
- medium
- Published
- Updated
- CVSS
- 6.8 · CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N
- CVSS v3
- 6.8 · CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N
Description
Impact
When calling the extended toHTMLEx method, it is possible to execute arbitrary JavaScript code.
Patches
The supplied patch resolves this vulnerability for SimpleXLSX. Use 1.1.13
Workarounds
Don't use data publication via toHTMLEx
This vulnerability was discovered by Aleksey Solovev (Positive Technologies)
CWEs
- CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')