{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-08-05T08:28:40.950","vulnerabilities":[{"cve":{"id":"CVE-2023-7101","sourceIdentifier":"mandiant-cve@google.com","published":"2023-12-24T22:15:07.983","lastModified":"2026-06-17T06:52:04.040","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Spreadsheet::ParseExcel version 0.65 is a Perl module used for parsing Excel files. Spreadsheet::ParseExcel is vulnerable to an arbitrary code execution (ACE) vulnerability due to passing unvalidated input from a file into a string-type “eval”. Specifically, the issue stems from the evaluation of Number format strings (not to be confused with printf-style format strings) within the Excel parsing logic."},{"lang":"es","value":"Spreadsheet::ParseExcel version 0.65 es un módulo Perl utilizado para analizar archivos Excel. Spreadsheet::ParseExcel es afectado por una vulnerabilidad de ejecución de código arbitrario (ACE) debido a que se pasa una entrada no validada de un archivo a una \"evaluación\" de tipo cadena. Específicamente, el problema surge de la evaluación de cadenas de formato numérico (que no deben confundirse con cadenas de formato de estilo printf) dentro de la lógica de análisis de Excel."}],"affected":[{"source":"mandiant-cve@google.com","affectedData":[{"vendor":"Douglas Wilson","product":"Spreadsheet::ParseExcel","defaultStatus":"affected","collectionURL":"https://metacpan.org/pod/Spreadsheet::ParseExcel","packageName":"Spreadsheet::ParseExcel","repo":"https://metacpan.org/release/DOUGW/Spreadsheet-ParseExcel-0.65/source/lib/Spreadsheet","versions":[{"version":"0.65","status":"affected"}]}]},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","affectedData":[{"vendor":"jmcnamara","product":"spreadsheet\\","defaultStatus":"unknown","cpes":["cpe:2.3:a:jmcnamara:spreadsheet\\:\\:parseexcel:0.41:*:*:*:*:perl:*:*"],"versions":[{"version":"0.41","lessThanOrEqual":"0.65","versionType":"custom","status":"affected"}]},{"vendor":"debian","product":"debian_linux","defaultStatus":"unknown","cpes":["cpe:2.3:o:debian:debian_linux:10:*:*:*:*:*:*:*"],"versions":[{"version":"10","status":"affected"}]},{"vendor":"fedoraproject","product":"fedora","defaultStatus":"unknown","cpes":["cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*","cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*"],"versions":[{"version":"38","status":"affected"},{"version":"39","status":"affected"}]},{"vendor":"fedoraproject","product":"fedora","defaultStatus":"unknown","cpes":["cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*","cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*"],"versions":[{"version":"38","status":"affected"},{"version":"39","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2025-08-20T03:56:14.026771Z","id":"CVE-2023-7101","options":[{"exploitation":"active"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"cisaExploitAdd":"2024-01-02","cisaActionDue":"2024-01-23","cisaRequiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","cisaVulnerabilityName":"Spreadsheet::ParseExcel Remote Code Execution Vulnerability","weaknesses":[{"source":"mandiant-cve@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-95"}]},{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-94"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:jmcnamara:spreadsheet\\:\\:parseexcel:*:*:*:*:*:perl:*:*","versionEndIncluding":"0.65","matchCriteriaId":"1C81AC37-3219-4A80-A89E-8BDC1E238F82"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*","matchCriteriaId":"07B237A9-69A3-4A9C-9DA0-4E06BD37AE73"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*","matchCriteriaId":"CC559B26-5DFC-4B7A-A27C-B77DE755DFF9"},{"vulnerable":true,"criteria":"cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*","matchCriteriaId":"B8EDB836-4E6A-4B71-B9B2-AA3E03E0F646"}]}]}],"references":[{"url":"http://www.openwall.com/lists/oss-security/2023/12/29/4","source":"mandiant-cve@google.com","tags":["Mailing List","Patch","Third Party Advisory"]},{"url":"https://github.com/jmcnamara/spreadsheet-parseexcel/blob/c7298592e102a375d43150cd002feed806557c15/lib/Spreadsheet/ParseExcel/Utility.pm#L171","source":"mandiant-cve@google.com","tags":["Product"]},{"url":"https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2023/MNDT-2023-0019.md","source":"mandiant-cve@google.com","tags":["Third Party Advisory"]},{"url":"https://https://github.com/haile01/perl_spreadsheet_excel_rce_poc","source":"mandiant-cve@google.com","tags":["Broken Link","Third Party Advisory"]},{"url":"https://https://github.com/jmcnamara/spreadsheet-parseexcel/commit/bd3159277e745468e2c553417b35d5d7dc7405bc","source":"mandiant-cve@google.com","tags":["Broken Link","Patch"]},{"url":"https://https://metacpan.org/dist/Spreadsheet-ParseExcel","source":"mandiant-cve@google.com","tags":["Broken Link","Product"]},{"url":"https://https://www.cve.org/CVERecord?id=CVE-2023-7101","source":"mandiant-cve@google.com","tags":["Broken Link","Third Party Advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2023/12/msg00025.html","source":"mandiant-cve@google.com","tags":["Mailing List"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IFEHKULQRVXHIV7XXK2RGD4VQN6Y4CV5/","source":"mandiant-cve@google.com","tags":["Broken Link","Mailing List"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/M2FIWDHRYTAAQLGM6AFOZVM7AFZ4H2ZR/","source":"mandiant-cve@google.com","tags":["Broken Link","Mailing List"]},{"url":"https://security.metacpan.org/2024/02/10/vulnerable-spreadsheet-parsing-modules.html","source":"mandiant-cve@google.com","tags":["Third Party Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2023/12/29/4","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Patch","Third Party Advisory"]},{"url":"https://github.com/jmcnamara/spreadsheet-parseexcel/blob/c7298592e102a375d43150cd002feed806557c15/lib/Spreadsheet/ParseExcel/Utility.pm#L171","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Product"]},{"url":"https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2023/MNDT-2023-0019.md","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]},{"url":"https://https://github.com/haile01/perl_spreadsheet_excel_rce_poc","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Broken Link","Third Party Advisory"]},{"url":"https://https://github.com/jmcnamara/spreadsheet-parseexcel/commit/bd3159277e745468e2c553417b35d5d7dc7405bc","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Broken Link","Patch"]},{"url":"https://https://metacpan.org/dist/Spreadsheet-ParseExcel","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Broken Link","Product"]},{"url":"https://https://www.cve.org/CVERecord?id=CVE-2023-7101","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Broken Link","Third Party Advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2023/12/msg00025.html","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IFEHKULQRVXHIV7XXK2RGD4VQN6Y4CV5/","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Broken Link","Mailing List"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/M2FIWDHRYTAAQLGM6AFOZVM7AFZ4H2ZR/","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Broken Link","Mailing List"]},{"url":"https://security.metacpan.org/2024/02/10/vulnerable-spreadsheet-parsing-modules.html","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-7101","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["US Government Resource"]}]}}]}