CVE-2024-56408
- Source
- https://cve.org/CVERecord?id=CVE-2024-56408
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-56408.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2024-56408
- Aliases
- Published
- 2025-01-03T16:05:22Z
- Modified
- 2026-10-21T02:30:37Z
- Severity
-
- 8.3 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:L/SI:H/SA:L CVSS Calculator
- Summary
- PhpSpreadsheet allows unauthorized reflected XSS in `Convert-Online.php` file
- Details
-
PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. Versions prior to 3.7.0, 2.3.5, 2.1.6, and 1.29.7 have no sanitization in the
/vendor/phpoffice/phpspreadsheet/samples/Engineering/Convert-Online.phpfile, which leads to the possibility of a cross-site scripting attack. Versions 3.7.0, 2.3.5, 2.1.6, and 1.29.7 contain a patch for the issue. - Database specific
{ "cna_assigner": "GitHub_M", "cwe_ids": [ "CWE-79" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/56xxx/CVE-2024-56408.json" }- References
-
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/56xxx/CVE-2024-56408.json
- https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-x88g-h956-m5xg
- https://nvd.nist.gov/vuln/detail/CVE-2024-56408
- https://github.com/PHPOffice/PhpSpreadsheet/commit/700a80346be269af668914172bc6f4521982d0b4
- https://github.com/PHPOffice/PhpSpreadsheet/commit/9b9a55c7154daa7cd4095f618933c240508ba3c1
- https://github.com/PHPOffice/PhpSpreadsheet/commit/a50ebfe118b3ae0ddaea1c48ac19dc38692f4abc
- https://github.com/PHPOffice/PhpSpreadsheet/commit/b8fac55aa5cb7a3d514c7308378bb37bb711b25e
Affected packages
Git / github.com/phpoffice/phpspreadsheet
Affected ranges
- Type
- GIT
- Repo
- https://github.com/phpoffice/phpspreadsheet
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixedIntroducedFixedIntroducedFixedIntroducedFixedFixedFixedFixedFixed
- Database specific
-
Show details
{ "extracted_events": [ { "cpe": "cpe:2.3:a:phpoffice:phpspreadsheet:*:*:*:*:*:*:*:*", "range": [ { "introduced": "0" }, { "fixed": "1.29.7" } ], "source": "CPE_RANGE" }, { "cpe": "cpe:2.3:a:phpoffice:phpspreadsheet:*:*:*:*:*:*:*:*", "range": [ { "introduced": "2.0.0" }, { "fixed": "2.1.6" } ], "source": "CPE_RANGE" }, { "cpe": "cpe:2.3:a:phpoffice:phpspreadsheet:*:*:*:*:*:*:*:*", "range": [ { "introduced": "2.2.0" }, { "fixed": "2.3.5" } ], "source": "CPE_RANGE" }, { "cpe": "cpe:2.3:a:phpoffice:phpspreadsheet:*:*:*:*:*:*:*:*", "range": [ { "introduced": "3.3.0" }, { "fixed": "3.7.0" } ], "source": "CPE_RANGE" }, { "range": [ { "fixed": "700a80346be269af668914172bc6f4521982d0b4" } ], "source": "REFERENCES_COMMIT" }, { "range": [ { "fixed": "9b9a55c7154daa7cd4095f618933c240508ba3c1" } ], "source": "REFERENCES_COMMIT" }, { "range": [ { "fixed": "a50ebfe118b3ae0ddaea1c48ac19dc38692f4abc" } ], "source": "REFERENCES_COMMIT" }, { "range": [ { "fixed": "b8fac55aa5cb7a3d514c7308378bb37bb711b25e" } ], "source": "REFERENCES_COMMIT" } ] }
Affected versions
1.*
1.0.0
1.0.0-beta2
1.1.0
1.10.0
1.10.1
1.11.0
1.12.0
1.13.0
1.14.0
1.14.1
1.15.0
1.16.0
1.17.0
1.17.1
1.18.0
1.19.0
1.2.0
1.2.1
1.20.0
1.21.0
1.22.0
1.23.0
1.24.0
1.24.1
1.25.0
1.25.1
1.25.2
1.27.0
1.28.0
1.29.0
1.29.1
1.29.2
1.29.4
1.29.5
1.29.6
1.3.0
1.3.1
1.4.0
1.4.1
1.5.0
1.6.0
1.7.0
1.8.0
1.8.1
1.8.2
2.*
2.0.0
2.1.0
2.1.1
2.1.3
2.1.4
2.1.5
2.2.0
2.2.1
2.2.2
2.3.0
2.3.2
2.3.3
2.3.4
3.*
3.3.0
3.4.0
3.5.0
3.6.0
Other
phpexcel-last-cherry-picked-commit
phpexcel-last-release-1.*
phpexcel-last-release-1.8.1