{"id":"CVE-2020-7776","published":"2020-12-09T16:45:18Z","modified":"2024-09-16T19:39:56Z","title":"Cross-site Scripting (XSS)","vendor":null,"product":null,"tier":"tail","description":{"text":"This affects the package phpoffice/phpspreadsheet from 0.0.0. The library is vulnerable to XSS when creating an html output from an excel file by adding a comment on any cell. The root cause of this issue is within the HTML writer where user comments are concatenated as part of link and this is returned as HTML. A fix for this issue is available on commit 0ed5b800be2136bcb8fa9c1bdf59abc957a98845/master branch.","provenance":"source","from":"CVE.org"},"cvss":{"score":7.1,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N/E:P/RL:O/RC:C","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.01317,"percentile":0.70754,"provenance":"source"},"cwes":[],"references":[{"url":"https://snyk.io/vuln/SNYK-PHP-PHPOFFICEPHPSPREADSHEET-1048856","tags":["x_refsource_MISC"]},{"url":"https://github.com/PHPOffice/PhpSpreadsheet/commit/0ed5b800be2136bcb8fa9c1bdf59abc957a98845","tags":["x_refsource_MISC"]},{"url":"https://github.com/PHPOffice/PhpSpreadsheet/blob/master/src/PhpSpreadsheet/Writer/Html.php%23L1792","tags":["x_refsource_MISC"]}],"priority":{"score":19.1,"factors":[{"name":"EPSS percentile","points":14.15},{"name":"CVSS severity","points":4.97}]},"affectedVersions":[{"vendor":"n/a","product":"phpoffice/phpspreadsheet","versions":[">= 0.0.0, < unspecified"]}],"affected":[{"ecosystem":"Packagist","package":"phpoffice/phpspreadsheet","vulnerableRanges":["<1.16.0"],"patched":["1.16.0"],"from":["GHSA-4mqv-gcr3-pff9"],"provenance":"source"},{"ecosystem":"Packagist","package":"phpoffice/phpexcel","vulnerableRanges":["<=1.8.2"],"patched":[],"from":["GHSA-4mqv-gcr3-pff9"],"provenance":"source"}],"euvd":{"id":"EUVD-2021-0945","exploited":false,"provenance":"source"},"lineage":{"packageHistory":[{"cve":"CVE-2018-19277","published":"2018-11-14","fixed":"1.5.1","kev":false},{"cve":"CVE-2019-12331","published":"2019-11-07","fixed":"1.8.0","kev":false,"link":{"from":"CVE-2019-12331","to":"CVE-2020-7776","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Packagist:phpoffice/phpspreadsheet","fromFixed":"1.8.0","toFixed":"1.16.0","daysApart":398}]}},{"cve":"CVE-2020-7776","published":"2020-12-09","fixed":"1.16.0","kev":false},{"cve":"CVE-2026-45034","published":"2026-06-22","fixed":"1.30.5","kev":false},{"cve":"CVE-2024-45046","published":"2024-08-28","fixed":"2.1.0","kev":false},{"cve":"CVE-2024-45048","published":"2024-08-28","fixed":"2.2.1","kev":false}],"package":"Packagist:phpoffice/phpspreadsheet"}}