CVE-2017-5992

HIGH

Python Openpyxl < 2.4.2 - XXE

Title source: rule

Description

Openpyxl 2.4.1 resolves external entities by default, which allows remote attackers to conduct XXE attacks via a crafted .xlsx document.

References (4)

Scores

CVSS v3 8.2
EPSS 0.0053
EPSS Percentile 66.8%
Attack Vector LOCAL
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:H

Classification

CWE
CWE-611
Status draft

Affected Products (2)

python/openpyxl
pypi/openpyxl < 2.4.2PyPI

Timeline

Published Feb 15, 2017
Tracked Since Feb 18, 2026