En resumen
- CVE-2014-2054 es una vulnerabilidad ALTO (CVSS 7.5) que afecta a phpoffice/phpexcel, owncloud server (owncloud), phpexcel (phpexcel project).
- Probabilidad de explotación en los próximos 30 días (EPSS): 1.5%, mayor que el 74.9% de las vulnerabilidades.
- Solución: actualizar a 1.8.0 o posterior.
| Package | Affected versions | Patched versions |
|---|
| phpoffice/phpexcel Packagist | < 1.8.0
| 1.8.0
|
| owncloud server | = 5.0.0= 5.0.1= 5.0.10= 5.0.11= 5.0.12= 5.0.13= 5.0.14= 5.0.2= 5.0.3= 5.0.4= 5.0.5= 5.0.6= 5.0.7= 5.0.8= 5.0.9= 6.0.0= 6.0.1≤ 5.0.14
| No fix yet |
| phpexcel | ≤ 1.7.9
| No fix yet |
Description
PHPExcel before 1.8.0, as used in ownCloud Server before 5.0.15 and 6.0.x before 6.0.2, does not disable external entity loading in libxml, which allows remote attackers to read arbitrary files, cause a denial of service, or possibly have other impact via an XML External Entity (XXE) attack.
NVD description
PHPExcel before 1.8.0, as used in ownCloud Server before 5.0.15 and 6.0.x before 6.0.2, does not disable external entity loading in libxml, which allows remote attackers to read arbitrary files, cause a denial of service, or possibly have other impact via an XML External Entity (XXE) attack.
Más vulnerabilidades de phpoffice/phpexcel
Ver todo →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free