PT-2023-21597 · Independentsoft · Jspreadsheet

Dominique Righetto · Publicado 2023-03-24 · Atualizado 2023-03-30 · CVE-2023-28151

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Independentsoft JSpreadsheet versions prior to 1.1.110

Description An issue was discovered in the API, which is prone to XML external entity (XXE) injection via a remote DTD in a DOCX file.

Recommendations For versions prior to 1.1.110, update to version 1.1.110 or later to resolve the issue.

Correção

XXE

Enumeração de Fraquezas

CWE-611

Identificadores relacionados

CVE-2023-28151

Produtos afetados

Jspreadsheet

Referências · 5

• https://nvd.nist.gov/vuln/detail/CVE-2023-28151 · Nota de Segurança
• https://cds.thalesgroup.com/en/tcs-cert/CVE-2023-28151 · Nota
• https://excellium-services.com/cert-xlm-advisory/CVE-2023-28151 · Nota
• https://independentsoft.de/jword/index.html · Nota
• https://osv.dev/vulnerability/CVE-2023-28151 · Aviso do Fabricante