Unscored severity · published Jun 4, 2014
CVE-2014-2054
PHPExcel before 1.8.0, as used in ownCloud Server before 5.0.15 and 6.0.x before 6.0.2, does not disable external entity loading in libxml, which allows remote attackers to read…
–
CVSS
1.5%
EPSS
No
On KEV
Description
PHPExcel before 1.8.0, as used in ownCloud Server before 5.0.15 and 6.0.x before 6.0.2, does not disable external entity loading in libxml, which allows remote attackers to read arbitrary files, cause a denial of service, or possibly have other impact via an XML External Entity (XXE) attack.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.5% · higher than 75% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OS
Owncloud Server · Owncloud
6.0.0; 6.0.1; through 5.0.14; 5.0.0; 5.0.1; 5.0.2; +12 more · source: NVD
PH
Phpexcel · Phpexcel Project
through 1.7.9; through 1.7.9 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2014-2054
CVE.org
https://www.cve.org/CVERecord?id=CVE-2014-2054
Vendor Advisory
http://owncloud.org/about/security/advisories/oC-SA-2014-006/
github.com
https://github.com/PHPOffice/PHPExcel/blob/develop/changelog.txt
More from Owncloud Server
9.8
CVE-2023-49105
ownCloud Improper Authentication Vulnerability
9.8
CVE-2014-2052
Zend Framework, as used in ownCloud Server before 5.0.15 and 6.0.x before 6.0.2, allows remote attackers to read arbitrary files, cause a denial of service, or possibly have other…
8.5
CVE-2016-1499
ownCloud Server before 8.0.10, 8.1.x before 8.1.5, and 8.2.x before 8.2.2 allow remote authenticated users to obtain sensitive information from a directory listing and possibly…
6.5
CVE-2021-29659
ownCloud 10.7 has an incorrect access control vulnerability, leading to remote information disclosure
6.5
CVE-2014-2050
Cross-site request forgery (CSRF) vulnerability in ownCloud Server before 5.0.15 and 6.0.x before 6.0.2 allows remote attackers to hijack the authentication of users for requests…