PT-2018-12317 · Phpoffice · Phpoffice Common

Tom4T0 · Publicado 2018-07-15 · Atualizado 2022-05-14 · CVE-2018-14065

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions PHPOffice Common versions prior to 0.2.9

Description The issue allows XXE (XML External Entity) attacks. This is related to the XMLReader.php file in PHPOffice Common.

Recommendations For versions prior to 0.2.9, update to version 0.2.9 or later to resolve the issue. As a temporary workaround, consider restricting the use of the XMLReader.php file until a patch is applied.

Correção

XXE

Enumeração de Fraquezas

CWE-611

Identificadores relacionados

CVE-2018-14065

GHSA-2853-HF2G-9843

Produtos afetados

Phpoffice Common

Referências · 7

• https://github.com/PHPOffice/PHPWord/issues/1421 · Nota
• https://github.com/PHPOffice/Common · Nota
• https://github.com/PHPOffice/Common/pull/23 · Nota
• https://github.com/PHPOffice/Common/releases/tag/0.2.9 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-14065 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2018-14065 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-2853-hf2g-9843 · Aviso do Fabricante