CVE-2023-7101: jmcnamara spreadsheet +2 lainnya

csirt@kutim:~/threat-intel/cve/CVE-2023-7101

CVSS 7.8 · High KEV · sudah dieksploitasi EPSS 19,1%

Kerentanan Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') pada jmcnamara spreadsheet, debian linux +1 lainnya. Skor CVSS 3.1 7.8 (High) menurut NVD. Masuk katalog KEV CISA pada 2 Januari 2024, artinya sudah terbukti dieksploitasi.

Deskripsi (NVD)

Spreadsheet::ParseExcel version 0.65 is a Perl module used for parsing Excel files. Spreadsheet::ParseExcel is vulnerable to an arbitrary code execution (ACE) vulnerability due to passing unvalidated input from a file into a string-type “eval”. Specifically, the issue stems from the evaluation of Number format strings (not to be confused with printf-style format strings) within the Excel parsing logic.

Rincian

Terbit di NVD: 24 Desember 2023
Terakhir diubah: 17 Juni 2026
Status NVD: Analyzed
CVSS 3.1: 7.8 (High), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')
CWE-94: Improper Control of Generation of Code ('Code Injection')
EPSS (30 hari): 19,1% peluang dieksploitasi; lebih tinggi dari 97,2% CVE lain

Known Exploited Vulnerabilities (CISA)

Nama: Spreadsheet::ParseExcel Remote Code Execution Vulnerability
Masuk KEV: 2 Januari 2024
Tenggat CISA: 23 Januari 2024 (untuk instansi federal AS)
Ransomware: Belum tercatat
Tindakan wajib: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
jmcnamara	spreadsheet	Semua versi hingga 0.65
debian	debian linux	Versi 10.0
fedoraproject	fedora	Versi 38
fedoraproject	fedora	Versi 39

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

http://www.openwall.com/lists/oss-security/2023/12/29/4 mailing list · patch · advisory pihak ketiga
https://https://github.com/jmcnamara/spreadsheet-parseexcel/commit/bd3159277e745468e2c553417b35d5d7dc7405bc broken link · patch
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-7101 pemerintah AS
https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2023/MNDT-2023-0019.md advisory pihak ketiga
https://https://github.com/haile01/perl_spreadsheet_excel_rce_poc broken link · advisory pihak ketiga
https://https://www.cve.org/CVERecord?id=CVE-2023-7101 broken link · advisory pihak ketiga
https://security.metacpan.org/2024/02/10/vulnerable-spreadsheet-parsing-modules.html advisory pihak ketiga
https://github.com/jmcnamara/spreadsheet-parseexcel/blob/c7298592e102a375d43150cd002feed806557c15/lib/Spreadsh... product
https://https://metacpan.org/dist/Spreadsheet-ParseExcel broken link · product
https://lists.debian.org/debian-lts-announce/2023/12/msg00025.html mailing list
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IFEHKULQRVXHIV7... broken link · mailing list
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/M2FIWDHRYTAAQLG... broken link · mailing list

Sumber: NVD · CVE.org · KEV CISA · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.