CVE-2023-7101 · Severity: critical · CVSS 7.8 · Exploited in the wild · Published 2024-01-02
Spreadsheet::ParseExcel is vulnerable to remote code execution due to the evaluation of unvalidated Number format strings from Excel files within a string-type eval function. This allows an attacker to execute arbitrary Perl code when a specially crafted spreadsheet is parsed by the library.
Quick answers
Is CVE-2023-7101 exploited in the wild?
Yes. CVE-2023-7101 is known to be exploited in the wild, first recorded on 2 January 2024. Treat it as urgent.
How severe is CVE-2023-7101?
Critical severity, with a CVSS score of 7.8, published 2 January 2024.
Which products and versions are affected?
jmcnamara Spreadsheet::ParseExcel 0.65.
Is there a fix for CVE-2023-7101?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2023-7101 attacked?
It is attacked with local access, in a software library.
Am I affected by CVE-2023-7101?
Check whether you run Spreadsheet::Parseexcel. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Affected products
jmcnamara Spreadsheet::ParseExcel 0.65
Timeline
2023-12-29: disclosed: Initial disclosure on oss-security mailing list
2024-01-02: advisory: NVD publication date
2024-01-02: kev added: Added to CISA Known Exploited Vulnerabilities catalog