CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
What the vulnerability does
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SpreadsheetConverter Import Spreadsheets from Microsoft Excel allows Stored XSS.This issue affects Import Spreadsheets from Microsoft Excel: from n/a through 10.1.3.
Explanation of Vulnerability in Simple Terms
SpreadsheetConverter's Import Spreadsheets from Microsoft Excel contains a cross-site scripting (XSS) vulnerability. An attacker with low-level access can inject malicious scripts into spreadsheet data. When another user views the imported content, the script executes in their browser, potentially stealing session data or performing actions on their behalf. The vulnerability requires user interaction to trigger.
What an attacker can do
Inject malicious scripts that execute in other users' browsers when they view imported spreadsheet data.
Potential impact on your site
Users' sessions and data at risk if they view spreadsheets containing injected malicious code.
Conditions required to exploit
Low-level user account and victim must view the attacker's crafted spreadsheet content.
Key dates
External resources
Related vulnerabilities
