CVE-2017-5992
HIGHopenpyxl < 2.4.2 - XML External Entity Injection via Crafted .xlsx Document
Title source: llmDescription
Openpyxl 2.4.1 resolves external entities by default, which allows remote attackers to conduct XXE attacks via a crafted .xlsx document.
References (4)
Core 4
Core References
Issue Tracking, Third Party Advisory x_refsource_confirm
https://bitbucket.org/openpyxl/openpyxl/issues/749
Issue Tracking, Third Party Advisory x_refsource_confirm
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=854442
Issue Tracking, Third Party Advisory x_refsource_confirm
https://bitbucket.org/openpyxl/openpyxl/commits/3b4905f428e1
Mailing List, Third Party Advisory x_refsource_confirm
http://www.openwall.com/lists/oss-security/2017/02/07/5
Scores
CVSS v3
8.2
EPSS
0.0053
EPSS Percentile
67.3%
Attack Vector
LOCAL
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:H
Details
CWE
CWE-611
Status
published
Products (2)
pypi/openpyxl
0 - 2.4.2PyPI
python/openpyxl
2.4.1
Published
Feb 15, 2017
Tracked Since
Feb 18, 2026