CVE search · CVE-2017-5992

CVE-2017-5992

high 8.2

Openpyxl 2.4.1 resolves external entities by default, which allows remote attackers to conduct XXE attacks via a crafted .xlsx document.

Open in the NVD CVE.org JSON

Status: Modified
Published: 2017-02-15
Last changed: 2026-06-17
Source: cve@mitre.org
Weakness: CWE-611

Severity

Version	Score	Vector	Source
CVSS 3.0	high 8.2	`CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:H`	nvd@nist.govPrimary
CVSS 2.0	medium 5.8	`AV:N/AC:M/Au:N/C:P/I:N/A:P`	nvd@nist.govPrimary

Affected products

Vendor and product from the NVD’s CPE applicability statements. Versions and conditions are on the NVD’s page.

python · openpyxl

References

http://www.openwall.com/lists/oss-security/2017/02/07/5Mailing ListThird Party Advisory
https://bitbucket.org/openpyxl/openpyxl/commits/3b4905f428e1Issue TrackingThird Party Advisory
https://bitbucket.org/openpyxl/openpyxl/issues/749Issue TrackingThird Party Advisory
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=854442Issue TrackingThird Party Advisory
http://www.openwall.com/lists/oss-security/2017/02/07/5Mailing ListThird Party Advisory
https://bitbucket.org/openpyxl/openpyxl/commits/3b4905f428e1Issue TrackingThird Party Advisory
https://bitbucket.org/openpyxl/openpyxl/issues/749Issue TrackingThird Party Advisory
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=854442Issue TrackingThird Party Advisory