PT-2022-16153

CVE-2022-23640

Published

2022-03-02

Updated

2023-07-24

Description by

CVSS 3.1

9.8

Critical

MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions xlsx-streamer versions prior to 2.1.0

Description The issue concerns the XML parser used in the Excel-Streaming-Reader, which did not apply all necessary settings to prevent XML Entity Expansion issues. This problem is resolved by upgrading to version 2.1.0. There is no known workaround for this issue.

Recommendations Upgrade to version 2.1.0 to receive a patch. As there is no known workaround, upgrading to the specified version is the recommended course of action to mitigate the risk associated with this issue.

Exploitability

Exploit

Fix

Impacts

Researchers

Pjfanning

Vendors

Affected products

Weakness enumeration

CWE-776: Improper Restriction of Recursive Entity References in DTDs (\'XML Entity Expansion\')

CWE-611: Improper Restriction of XML External Entity Reference

Related identifiers