CVE-2023-7101

Description

Spreadsheet::ParseExcel version 0.65 is a Perl module used for parsing Excel files. Spreadsheet::ParseExcel is vulnerable to an arbitrary code execution (ACE) vulnerability due to passing unvalidated input from a file into a string-type “eval”. Specifically, the issue stems from the evaluation of Number format strings (not to be confused with printf-style format strings) within the Excel parsing logic.

Severity scores

Each score is shown as its source gave it. They are not averaged or merged.

• 7.8CVSS 3.1, Highfrom CISA (ADP container)CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

What to do

• Update to version 0.66CNA solution statement
• Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.CISA KEV required action

Historical context and remediation

This reference retains the original CVE publication date. A recent record update does not mean a new attack occurred.

CAPEC-137: Parameter Injection (CNA impact statement)

Version statuses below come from the CNA. An “unaffected” version is not necessarily a currently supported release or proof of a patch date. EPSS is a dated risk estimate, not a count of historical attacks.

Read the original CVE record.

Affected products

Timeline

1. 24 Dec 2023 Published
2. 2 Jan 2024 CVE-2023-7101 added to CISA KEV
3. 2 Jan 2024 Added to the CISA KEV catalogue

Weakness

• CWE-95

References

• github.com
• https
• https
• https
• github.com
• www.openwall.com
• lists.debian.org
• https
• lists.fedoraproject.org
• lists.fedoraproject.org
• security.metacpan.org