CVE-2023-7101
high-risk
Published 2023-12-24
Spreadsheet::ParseExcel version 0.65 is a Perl module used for parsing Excel files. Spreadsheet::ParseExcel is vulnerable to an arbitrary code execution (ACE) vulnerability due to passing unvalidated input from a file into a string-type “eval”. Specifically, the issue stems from the evaluation of Number format strings (not to be confused with printf-style format strings) within the Excel parsing logic.
Do I need to act?
!
83.3% chance of exploitation in next 30 days
EPSS score — higher than 17% of all CVEs
!
CISA KEV: actively exploited in the wild
On the Known Exploited Vulnerabilities catalog — federal agencies must patch
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
7
CVSS 7.8/10
High
LOCAL
/ LOW complexity
Affected Products (4)
Affected Vendors
References (23)
Third Party Advisory
https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2023/MNDT-2023...
Third Party Advisory
https://security.metacpan.org/2024/02/10/vulnerable-spreadsheet-parsing-modules....
Third Party Advisory
https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2023/MNDT-2023...
and 3 more references
61
/ 100
high-risk
Severity
24/34 · High
Exploitability
27/34 · High
Exposure
10/34 · Low