Vulnerability Details CVE-2021-32013
SheetJS and SheetJS Pro through 0.16.9 allows attackers to cause a denial of service (memory consumption) via a crafted .xlsx document that is mishandled when read by xlsx.js (issue 2 of 2).
Exploit prediction scoring system (EPSS) score
EPSS Score 0.002
EPSS Ranking 44.1%
CVSS Severity
CVSS v3 Score 5.5
CVSS v2 Score 4.3
References
- https://floqast.com/engineering-blog/post/fuzzing-and-parsing-securely/
- https://sheetjs.com/pro
- https://www.npmjs.com/package/xlsx/v/0.17.0
- https://www.oracle.com/security-alerts/cpujan2022.html
- https://floqast.com/engineering-blog/post/fuzzing-and-parsing-securely/
- https://sheetjs.com/pro
- https://www.npmjs.com/package/xlsx/v/0.17.0
- https://www.oracle.com/security-alerts/cpujan2022.html
Products affected by CVE-2021-32013
-
cpe:2.3:a:oracle:rest_data_services:-
-
cpe:2.3:a:oracle:rest_data_services:11.2.0.4
-
cpe:2.3:a:oracle:rest_data_services:12.1.0.2
-
cpe:2.3:a:oracle:rest_data_services:12.2.0.1
-
cpe:2.3:a:oracle:rest_data_services:18c
-
cpe:2.3:a:oracle:rest_data_services:19c
-
cpe:2.3:a:oracle:rest_data_services:20.2.1
-
cpe:2.3:a:oracle:rest_data_services:20.4.3.050.1904
-
cpe:2.3:a:oracle:rest_data_services:21.2
-
cpe:2.3:a:sheetjs_project:sheetjs:*
-
cpe:2.3:a:sheetjs_project:sheetjs_pro:*