PT-2018-12317 · Phpoffice · Phpoffice Common

Tom4T0 · Published 2018-07-15 · Updated 2022-05-14 · CVE-2018-14065

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions PHPOffice Common versions prior to 0.2.9

Description The issue allows XXE (XML External Entity) attacks. This is related to the XMLReader.php file in PHPOffice Common.

Recommendations For versions prior to 0.2.9, update to version 0.2.9 or later to resolve the issue. As a temporary workaround, consider restricting the use of the XMLReader.php file until a patch is applied.

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2018-14065

GHSA-2853-HF2G-9843

Affected Products

Phpoffice Common

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2018-14065 · Security Note
• https://osv.dev/vulnerability/CVE-2018-14065 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-2853-hf2g-9843 · Vendor Advisory
• https://github.com/PHPOffice/PHPWord/issues/1421 · Note
• https://github.com/PHPOffice/Common · Note
• https://github.com/PHPOffice/Common/pull/23 · Note
• https://github.com/PHPOffice/Common/releases/tag/0.2.9 · Note