PHPExcel CVE-2014-2054 XML External Entity Information Disclosure Vulnerability
BID:66172
Info
PHPExcel CVE-2014-2054 XML External Entity Information Disclosure Vulnerability
| Bugtraq ID: | 66172 |
| Class: | Design Error |
| CVE: |
CVE-2014-2054 |
| Remote: | Yes |
| Local: | No |
| Published: | Mar 02 2014 12:00AM |
| Updated: | Mar 17 2014 12:34AM |
| Credit: | The vendor reported this issue. |
| Vulnerable: | |
| Not Vulnerable: | |
Discussion
PHPExcel CVE-2014-2054 XML External Entity Information Disclosure Vulnerability
PHPExcel is prone to an information-disclosure vulnerability.
An attacker can exploit this issue to gain access to sensitive information that may lead to further attacks. Given the nature of this issue, attacker may also be able to cause a denial-of-service condition.
Versions prior to PHPExcel 1.8.0 are vulnerable.
PHPExcel is prone to an information-disclosure vulnerability.
An attacker can exploit this issue to gain access to sensitive information that may lead to further attacks. Given the nature of this issue, attacker may also be able to cause a denial-of-service condition.
Versions prior to PHPExcel 1.8.0 are vulnerable.
Exploit / POC
PHPExcel CVE-2014-2054 XML External Entity Information Disclosure Vulnerability
An attacker can exploit this issue using readily available tools.
An attacker can exploit this issue using readily available tools.
Solution / Fix
PHPExcel CVE-2014-2054 XML External Entity Information Disclosure Vulnerability
Solution:
Updates are available. Please see the references or vendor advisory for more information.
Solution:
Updates are available. Please see the references or vendor advisory for more information.
References
PHPExcel CVE-2014-2054 XML External Entity Information Disclosure Vulnerability
References:
References: