What is GHSA-xvm2-9xvc-hx7f?

GHSA-xvm2-9xvc-hx7f is a security advisory published by GitHub Security Advisories with Critical severity. Improper Restriction of XML External Entity Reference in com.monitorjbl:xlsx-streamer

Which CVE IDs does GHSA-xvm2-9xvc-hx7f cover?

GHSA-xvm2-9xvc-hx7f covers the following CVE IDs: CVE-2022-23640. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-xvm2-9xvc-hx7f?

GHSA-xvm2-9xvc-hx7f has a CVSS v3 base score of 9.8, published by GitHub Security Advisories.

Which products are affected by GHSA-xvm2-9xvc-hx7f?

GHSA-xvm2-9xvc-hx7f affects 1 product, including: maven/com.monitorjbl:xlsx-streamer:\u003c 2.1.0.

GHSA-xvm2-9xvc-hx7fCriticalCVSS 9.8

Improper Restriction of XML External Entity Reference in com.monitorjbl:xlsx-streamer

Vendor

GitHub Security Advisories

Published

March 2, 2022

Last Modified

July 24, 2023

🔗 CVE IDs covered (1)

CVE-2022-23640 →

📋 Description

Impact

Prior to xlsx-streamer 2.1.0, the XML parser that was used did not apply all the necessary settings to prevent XML Entity Expansion issues.

Patches

Upgrade to version 2.1.0.

Workarounds

No known workaround.

References

https://github.com/monitorjbl/excel-streaming-reader/commit/0749c7b9709db078ccdeada16d46a34bc2910c73

For more information

If you have any questions or comments about this advisory:

Open an issue in monitorjbl/excel-streaming-reader

🎯 Affected products1

maven/com.monitorjbl:xlsx-streamer:< 2.1.0

🔗 References (4)

https://github.com/monitorjbl/excel-streaming-reader/security/advisories/GHSA-xvm2-9xvc-hx7f
https://nvd.nist.gov/vuln/detail/CVE-2022-23640
https://github.com/monitorjbl/excel-streaming-reader/commit/0749c7b9709db078ccdeada16d46a34bc2910c73
https://github.com/advisories/GHSA-xvm2-9xvc-hx7f