CVE-2023-7101
Assigner: Mandiant
Published: 2023-12-24T21:34:46.527Z
State: PUBLISHED
affected: collectionURL: https://metacpan.org/pod/Spreadsheet::ParseExcel
defaultStatus: affected
packageName: Spreadsheet::ParseExcel
product: Spreadsheet::ParseExcel
repo: https://metacpan.org/release/DOUGW/Spreadsheet-ParseExcel-0.65/source/lib/Spreadsheet
vendor: Douglas Wilson
versions: status: affected
version: 0.65
credits: type: finder
user: 00000000-0000-4000-9000-000000000000
value: Le Dinh Hai (https://github.com/haile01/perl_spreadsheet_excel_rce_poc/tree/main) 
type: reporter
user: 00000000-0000-4000-9000-000000000000
value: Barracuda Networks Inc.  https://www.barracuda.com/
descriptions: supportingMedia: base64: no
type: text/html
value: <span style="background-color: transparent;">Spreadsheet::ParseExcel version 0.65 is a Perl module used for parsing Excel files. Spreadsheet::ParseExcel is vulnerable to an arbitrary</span> <span style="background-color: transparent;">code execution (ACE) vulnerability due to passing unvalidated input from a file into a string-type “eval”. Specifically, the issue stems from the evaluation of Number format strings (not to be confused with printf-style format strings) within the Excel parsing logic. </span><br>
value: Spreadsheet::ParseExcel version 0.65 is a Perl module used for parsing Excel files. Spreadsheet::ParseExcel is vulnerable to an arbitrary code execution (ACE) vulnerability due to passing unvalidated input from a file into a string-type “eval”. Specifically, the issue stems from the evaluation of Number format strings (not to be confused with printf-style format strings) within the Excel parsing logic. 

impacts: capecId: CAPEC-137
descriptions: value: CAPEC-137: Parameter Injection
problemTypes: descriptions: cweId: CWE-95
description: CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')
type: CWE
solutions: supportingMedia: base64: no
type: text/html
value: Update to version 0.66<br>
value: Update to version 0.66

source: discovery: UNKNOWN
title: Arbitrary Code Execution (ACE) Vulnerability
x_generator: engine: Vulnogram 0.1.0-dev