CVE-2023-7101 vulnerability in Jmcnamara and Other Products
Published on December 24, 2023
Known Exploited Vulnerability
This Spreadsheet::ParseExcel Remote Code Execution Vulnerability is part of CISA's list of Known Exploited Vulnerabilities. Spreadsheet::ParseExcel contains a remote code execution vulnerability due to passing unvalidated input from a file into a string-type “eval”. Specifically, the issue stems from the evaluation of Number format strings within the Excel parsing logic.
The following remediation steps are recommended / required by January 23, 2024: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Vulnerability Analysis
CVE-2023-7101 can be exploited with local system access, requires user interaction. This vulnerability is considered to have a low attack complexity. It has an exploitability score of 1.8 out of four. The potential impact of an exploit of this vulnerability is considered to be very high.
What is a Code Injection Vulnerability?
The software constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
CVE-2023-7101 has been classified to as a Code Injection vulnerability or weakness.
Products Associated with CVE-2023-7101
You can be notified by stack.watch whenever vulnerabilities like CVE-2023-7101 are published in these products:
What versions are vulnerable to CVE-2023-7101?
-
Jmcnamara Spreadsheet
Version \
through 0.65
parseexcel
-
Debian Linux
Version 10.0
-
Fedora Project Fedora
Version 38
-
Fedora Project Fedora
Version 39