PT-2022-16153 · Unknown · Xlsx-Streamer

Pjfanning · Published 2022-03-02 · Updated 2023-07-24 · CVE-2022-23640

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions xlsx-streamer versions prior to 2.1.0

Description The issue concerns the XML parser used in the Excel-Streaming-Reader, which did not apply all necessary settings to prevent XML Entity Expansion issues. This problem is resolved by upgrading to version 2.1.0. There is no known workaround for this issue.

Recommendations Upgrade to version 2.1.0 to receive a patch. As there is no known workaround, upgrading to the specified version is the recommended course of action to mitigate the risk associated with this issue.

Exploit

Fix

XML Entity Expansion

XXE

Weakness Enumeration

CWE-776

CWE-611

Related Identifiers

CVE-2022-23640

GHSA-XVM2-9XVC-HX7F

Affected Products

Xlsx-Streamer

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/23xxx/CVE-2022-23640.json · Exploit
• https://github.com/monitorjbl/excel-streaming-reader/security/advisories/GHSA-xvm2-9xvc-hx7f · Patch
• https://github.com/monitorjbl/excel-streaming-reader/commit/0749c7b9709db078ccdeada16d46a34bc2910c73 · Patch
• https://osv.dev/vulnerability/GHSA-xvm2-9xvc-hx7f · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-23640 · Security Note
• https://osv.dev/vulnerability/CVE-2022-23640 · Vendor Advisory
• https://github.com/monitorjbl/excel-streaming-reader · Note
• https://t.me/cvenotify/27620 · Telegram Post
• https://t.me/cibsecurity/38321 · Telegram Post