CVE-2023-7101
HighActively exploited (CISA KEV)
Description
Spreadsheet::ParseExcel version 0.65 is a Perl module used for parsing Excel files. Spreadsheet::ParseExcel is vulnerable to an arbitrary code execution (ACE) vulnerability due to passing unvalidated input from a file into a string-type “eval”. Specifically, the issue stems from the evaluation of Number format strings (not to be confused with printf-style format strings) within the Excel parsing logic.
SeverityHigh
CVSS7.8
Exploit probability—
Product
Spreadsheet::ParseExcel
PublishedDec 24, 2023
First seenDec 24, 2023
Added to KEVJan 2, 2024
Weakness typeCWE-95CWE-95
How to fix
CISA required action
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CISA due date: Jan 23, 2024Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| jmcnamara spreadsheet\ | \ ≤ v ≤ 0.65 | — |
| debian debian_linux | 10.0 | — |
| fedoraproject fedora | 38, 39 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.