GHSA-4mqv-gcr3-pff9MediumCVSS 6.4
Cross-site scripting in phpoffice/phpspreadsheet
🔗 CVE IDs covered (1)
📋 Description
This affects the package phpoffice/phpspreadsheet. The library is vulnerable to XSS when creating an html output from an excel file by adding a comment on any cell. The root cause of this issue is within the HTML writer where user comments are concatenated as part of link and this is returned as HTML.
🎯 Affected products2
- composer/phpoffice/phpspreadsheet:< 1.16.0
- composer/phpoffice/phpexcel:<= 1.8.2
🔗 References (7)
- https://nvd.nist.gov/vuln/detail/CVE-2020-7776
- https://github.com/PHPOffice/PhpSpreadsheet/commit/0ed5b800be2136bcb8fa9c1bdf59abc957a98845
- https://github.com/PHPOffice/PhpSpreadsheet/blob/master/src/PhpSpreadsheet/Writer/Html.php%23L1792
- https://snyk.io/vuln/SNYK-PHP-PHPOFFICEPHPSPREADSHEET-1048856
- https://github.com/PHPOffice/PhpSpreadsheet/pull/1719
- https://github.com/FriendsOfPHP/security-advisories/blob/master/phpoffice/phpspreadsheet/CVE-2020-7776.yaml
- https://github.com/advisories/GHSA-4mqv-gcr3-pff9