What is CVE-2023-7101?

CVE-2023-7101 is a high-severity vulnerability in Spreadsheet::ParseExcel version 0.65, a Perl module for parsing Excel files. This vulnerability allows arbitrary code execution due to unvalidated input passed into a string-type "eval." Users should upgrade to version 0.66 to mitigate the threat.

Who is impacted by CVE-2023-7101?

CVE-2023-7101 affects users of Spreadsheet::ParseExcel version 0.65 and earlier, and products that depend on it, like Spreadsheet::ParseXLSX. This vulnerability can lead to arbitrary code execution, so users should upgrade to a secure version to avoid risk

What to do if CVE-2023-7101 affected you

If you're affected by the CVE-2023-7101 vulnerability, it's crucial to take action to protect your system. Here's what you should do:

1. Upgrade to Spreadsheet::ParseExcel version 0.66

2. Apply the provided patch if you're unable to upgrade immediately

3. Stay informed about future updates and security best practices

Is this in CISA’s Known Exploited Vulnerabilities Catalog?

The CVE-2023-7101 vulnerability, also known as the Spreadsheet::ParseExcel Remote Code Execution Vulnerability, is indeed listed in CISA's Known Exploited Vulnerabilities Catalog. It was added on January 2, 2024, with a due date of January 23, 2024. To address this vulnerability, users should apply mitigations as per vendor instructions or discontinue using the affected product if no mitigations are available.

Weakness Enumeration

The weakness enumeration for this vulnerability is categorized as CWE-94 Code Injection and CWE-95 Eval Injection, which involve improper control of code generation and neutralization of directives in dynamically evaluated code.

Learn More

For a comprehensive understanding of its description, severity, technical details, and affected software configurations, refer to the NVD page and the sources listed below.

• OSS Security - CVE-2023-7101

• Mandiant Vulnerability Disclosures - MNDT-2023-0019