CVE-2024-56412

MEDIUM EPSS 28.5%
Published Jan 3, 20251y ago · Modified Jun 17, 20262w ago
4.8 CVSS 4.0
Medium
Find Similar
Published Jan 3, 2025 1y ago
Last Modified Jun 17, 2026 2w ago

Description

PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. Versions prior to 3.7.0, 2.3.5, 2.1.6, and 1.29.7 are vulnerable to bypass of the cross-site scripting sanitizer using the javascript protocol and special characters. An attacker can use special characters, so that the library processes the javascript protocol with special characters and generates an HTML link. Versions 3.7.0, 2.3.5, 2.1.6, and 1.29.7 contain a patch for the issue.

CVSS Details

Base Score
4.8
Exploitability
—
Impact
—
Vector string
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector Network
Attack Complexity Low
Privileges Required Low
User Interaction A
Scope X

Threat Intelligence

EPSS Exploit Probability
28.5% percentile
Exploit & Patch Status
Public Exploit Known
Patch Available

Weaknesses 1

CWE-79 Cross-site Scripting Injection

Affected Products 4

VendorProductVersionRange
phpofficephpspreadsheet* <1.29.7
phpofficephpspreadsheet*≥2.0.0  –  <2.1.6
phpofficephpspreadsheet*≥2.2.0  –  <2.3.5
phpofficephpspreadsheet*≥3.0.0  –  <3.7.0

References 2

  • github.com https://github.com/PHPOffice/PhpSpreadsheet/commit/45052f88e04c735d56457a8ffcdc40b2635a028e
    Patch
  • github.com https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-q9jv-mm3r-j47r
    ExploitVendor Advisory

Remediation

  • github.com https://github.com/PHPOffice/PhpSpreadsheet/commit/45052f88e04c735d56457a8ffcdc40b2635a028e
    Patch