CISA KEV · Known exploitedHigh

CVE-2023-7101

Spreadsheet::ParseExcel

Spreadsheet::ParseExcel version 0.65 is a Perl module used for parsing Excel files. Spreadsheet::ParseExcel is vulnerable to an arbitrary code execution (ACE) vulnerability due to passing unvalidated input from a file into a string-type “eval”. Specifically, the issue stems from the evaluation of Number format strings (not to be confused with printf-style format strings) within the Excel parsing logic.

CVSS: 7.8
EPSS: 16.8%
CISA KEV: Listed
Published: 2023.12.25

PRIORITY ASSESSMENT

Immediate review

CISA has listed this vulnerability in the Known Exploited Vulnerabilities catalog.

Known exploitationConfirmed by CISA KEV

Exploit probability16.8%

Technical severityCVSS 7.8

Vulnerability overview

Affected product and versions

Product: Spreadsheet::ParseExcel
Affected versions: 0.65, 0.41, 10, 38, 39, <= 0.65, 10.0
Fixed versions: No verified fixed-version field is available yet

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide

CISA required action

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Due date: 2024.01.23

1
Identify
Confirm that Spreadsheet::ParseExcel and an affected version are present.
2
Prioritize
Combine exploitation signals with asset exposure and business criticality.
3
Remediate
Follow the vendor advisory or supported update path and preserve rollback options.
4
Verify
Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE: CWE-94, CWE-95
KEV added: 2024.01.02
Ransomware use: 미확인