Spreadsheet::ParseExcel Remote Code Execution Vulnerability
Summary
| CVE | CVE-2023-7101 |
|---|---|
| State | PUBLISHED |
| Assigner | Unknown |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2023-12-24 22:15:00 UTC |
| Updated | 2024-01-08 03:15:00 UTC |
| Description | Spreadsheet::ParseExcel contains a remote code execution vulnerability due to passing unvalidated input from a file into a string-type “eval”. Specifically, the issue stems from the evaluation of Number format strings within the Excel parsing logic. |
Risk And Classification
EPSS: 0.168320000 probability, percentile 0.967200000 (date 2026-07-22)
CISA KEV: Listed on 2024-01-02; due 2024-01-23; ransomware use Unknown
CISA Known Exploited Vulnerability
| Vendor | Spreadsheet::ParseExcel |
|---|---|
| Product | Spreadsheet::ParseExcel |
| Name | Spreadsheet::ParseExcel Remote Code Execution Vulnerability |
| Required Action | Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. |
| Notes | This vulnerability affects a common open-source component, third-party library, or a protocol used by different products. Please check with specific vendors for information on patching status. For more information, please see: https://metacpan.org/dist/Spreadsheet-ParseExcel and Barracuda's specific implementation and fix for their downstream issue CVE-2023-7102 at https://www.barracuda.com/company/legal/esg-vulnerability; https://nvd.nist.gov/vuln/detail/CVE-2023-7101 |
There are no known software configurations currently associated with this CVE in NVD or the CVE Program record.
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| github.com/mandiant/Vulnerability-Disclosures/blob/master/2023/MNDT-2023... | github.com | ||
| lists.fedoraproject.org/archives/list/[email protected]/messag... | lists.fedoraproject.org | ||
| https/github.com/haile01/perl_spreadsheet_excel_rce_poc | https | ||
| https/github.com/jmcnamara/spreadsheet-parseexcel/commit/bd3159277e... | https | ||
| https/www.cve.org/CVERecord | https | ||
| https/metacpan.org/dist/Spreadsheet-ParseExcel | https | ||
| lists.debian.org/debian-lts-announce/2023/12/msg00025.html | lists.debian.org | ||
| www.openwall.com/lists/oss-security/2023/12/29/4 | www.openwall.com | ||
| github.com/jmcnamara/spreadsheet-parseexcel/blob/c7298592e102a375d43150c... | github.com | ||
| lists.fedoraproject.org/archives/list/[email protected]/messag... | lists.fedoraproject.org | ||
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
| CISA Known Exploited Vulnerabilities catalog | CISA | www.cisa.gov | kev |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 285070 Fedora Security Update for perl (FEDORA-2023-921f6975c2)
- 357033 Amazon Linux Security Advisory for perl-Spreadsheet-ParseExcel : ALAS2023-2024-491
- 357043 Amazon Linux Security Advisory for perl-Spreadsheet-ParseExcel : ALAS-2024-1905
- 505789 Alpine Linux Security Update for perl-spreadsheet-parseexcel
- 6000414 Debian Security Update for libspreadsheet-parseexcel-perl (DSA 5592-1)
- 6000417 Debian Security Update for libspreadsheet-parseexcel-perl (DLA 3702-1)
- 691422 Free Berkeley Software Distribution (FreeBSD) Security Update for p5 (cb22a9a6-c907-11ee-8d1c-40b034429ecf)
- 755629 SUSE Enterprise Linux Security Update for perl-Spreadsheet-ParseExcel (SUSE-SU-2024:0158-1)