CVEDB API

securityScan() in PHPOffice PhpSpreadsheet through 1.5.0 allows a bypass of protection mechanisms for XXE via UTF-7 encoding in a .xlsx file

Exploit prediction scoring system (EPSS) score

EPSS Score 0.019

EPSS Ranking 82.3%

CVSS Severity

CVSS v3 Score 8.8

CVSS v2 Score 6.8

References

Products affected by CVE-2018-19277

Phpoffice » Phpspreadsheet » Version: N/A

cpe:2.3:a:phpoffice:phpspreadsheet:-
Phpoffice » Phpspreadsheet » Version: 1.0.0

cpe:2.3:a:phpoffice:phpspreadsheet:1.0.0
Phpoffice » Phpspreadsheet » Version: 1.1.0

cpe:2.3:a:phpoffice:phpspreadsheet:1.1.0
Phpoffice » Phpspreadsheet » Version: 1.2.0

cpe:2.3:a:phpoffice:phpspreadsheet:1.2.0
Phpoffice » Phpspreadsheet » Version: 1.2.1

cpe:2.3:a:phpoffice:phpspreadsheet:1.2.1
Phpoffice » Phpspreadsheet » Version: 1.3.0

cpe:2.3:a:phpoffice:phpspreadsheet:1.3.0
Phpoffice » Phpspreadsheet » Version: 1.3.1

cpe:2.3:a:phpoffice:phpspreadsheet:1.3.1
Phpoffice » Phpspreadsheet » Version: 1.4.0

cpe:2.3:a:phpoffice:phpspreadsheet:1.4.0
Phpoffice » Phpspreadsheet » Version: 1.4.1

cpe:2.3:a:phpoffice:phpspreadsheet:1.4.1
Phpoffice » Phpspreadsheet » Version: 1.5.0

cpe:2.3:a:phpoffice:phpspreadsheet:1.5.0