CVE-2014-2054
Estado: ModificadaAlta (7.5)—
PHPExcel before 1.8.0, as used in ownCloud Server before 5.0.15 and 6.0.x before 6.0.2, does not disable external entity loading in libxml, which allows remote attackers to read arbitrary files, cause a denial of service, or possibly have other impact via an XML External Entity (XXE) attack.
CVSS
- Versión: 2.0
- Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
- Puntuación base: 7.5
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 1.54%
- Percentil entre todas las CVEs puntuadas: 74
- Fecha de la puntuación: 6/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (2)
CWE
- NVD-CWE-Other
Referencias
JSON original (NVD)
Mostrar
{
"id": "CVE-2014-2054",
"cveTags": [],
"metrics": {
"cvssMetricV2": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"version": "2.0",
"baseScore": 7.5,
"accessVector": "NETWORK",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"authentication": "NONE",
"integrityImpact": "PARTIAL",
"accessComplexity": "LOW",
"availabilityImpact": "PARTIAL",
"confidentialityImpact": "PARTIAL"
},
"acInsufInfo": false,
"impactScore": 6.4,
"baseSeverity": "HIGH",
"obtainAllPrivilege": false,
"exploitabilityScore": 10,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": false
}
]
},
"affected": [
{
"source": "cve@mitre.org",
"affectedData": [
{
"vendor": "n/a",
"product": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
]
}
],
"published": "2014-06-04T14:55:03.983",
"references": [
{
"url": "http://owncloud.org/about/security/advisories/oC-SA-2014-006/",
"tags": [
"Vendor Advisory"
],
"source": "cve@mitre.org"
},
{
"url": "https://github.com/PHPOffice/PHPExcel/blob/develop/changelog.txt",
"source": "cve@mitre.org"
},
{
"url": "http://owncloud.org/about/security/advisories/oC-SA-2014-006/",
"tags": [
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://github.com/PHPOffice/PHPExcel/blob/develop/changelog.txt",
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "PHPExcel before 1.8.0, as used in ownCloud Server before 5.0.15 and 6.0.x before 6.0.2, does not disable external entity loading in libxml, which allows remote attackers to read arbitrary files, cause a denial of service, or possibly have other impact via an XML External Entity (XXE) attack."
},
{
"lang": "es",
"value": "PHPExcel anterior a 1.8.0, utilizado en ownCloud Server anterior a 5.0.15 y 6.0.x anterior a 6.0.2, no deshabilita la carga de entidades externas en libxml, lo que permite a atacantes remotos leer archivos arbitrarios, causar una denegación de servicio o posiblemente tener otro impacto a través de un ataque de entidad externa XML (XXE)."
}
],
"lastModified": "2026-06-17T00:06:00.010",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:owncloud:owncloud_server:6.0.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "5927D266-65D2-4E6E-A5E7-2F572E411B8E"
},
{
"criteria": "cpe:2.3:a:owncloud:owncloud_server:6.0.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "EA0FCB53-D1BB-45FB-BC2D-FF5EDD2A980C"
},
{
"criteria": "cpe:2.3:a:phpexcel_project:phpexcel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "3F54EA98-9036-41FD-B69C-8B2FA7D07E3B",
"versionEndIncluding": "1.7.9"
}
],
"operator": "OR"
}
]
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:owncloud:owncloud_server:*:a:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "1786093A-E86B-4099-B0BE-2545E8CAFFFC",
"versionEndIncluding": "5.0.14"
},
{
"criteria": "cpe:2.3:a:owncloud:owncloud_server:5.0.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D89BE316-CE49-49CB-85FB-B93C86E07276"
},
{
"criteria": "cpe:2.3:a:owncloud:owncloud_server:5.0.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "BD902884-4F28-4AF6-A8D7-A6CD15048B0C"
},
{
"criteria": "cpe:2.3:a:owncloud:owncloud_server:5.0.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B18395A6-B385-4ADB-9278-5F59FF339F1F"
},
{
"criteria": "cpe:2.3:a:owncloud:owncloud_server:5.0.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "94834DA8-247E-4A53-A95A-708AF7F9AC4E"
},
{
"criteria": "cpe:2.3:a:owncloud:owncloud_server:5.0.4:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "35203A98-76CE-4475-9C4A-60E6A1990B8A"
},
{
"criteria": "cpe:2.3:a:owncloud:owncloud_server:5.0.5:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "0B1C940B-E6FE-41D5-8313-E6498331E9F5"
},
{
"criteria": "cpe:2.3:a:owncloud:owncloud_server:5.0.6:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F530C316-3FAC-4F1A-8AFA-7E9300EFDFFD"
},
{
"criteria": "cpe:2.3:a:owncloud:owncloud_server:5.0.7:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "14EDBCD8-08D3-4730-BA07-2F1B3E0B5FD9"
},
{
"criteria": "cpe:2.3:a:owncloud:owncloud_server:5.0.8:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "1368B598-A061-4AB1-8B45-4E2F87AA0CF5"
},
{
"criteria": "cpe:2.3:a:owncloud:owncloud_server:5.0.9:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "8E3A73DB-414D-4E84-9929-CF57F31E407C"
},
{
"criteria": "cpe:2.3:a:owncloud:owncloud_server:5.0.10:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "23EE5509-FF8F-42A5-9002-A9BC5A4178C5"
},
{
"criteria": "cpe:2.3:a:owncloud:owncloud_server:5.0.11:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "8FC6B240-1040-465B-B6B1-133651A6374B"
},
{
"criteria": "cpe:2.3:a:owncloud:owncloud_server:5.0.12:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "DB2BEBED-B273-4779-8168-7168F1B32CDC"
},
{
"criteria": "cpe:2.3:a:owncloud:owncloud_server:5.0.13:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C91EB5FD-9B1C-41A3-B76F-5FC2A3FA3C10"
},
{
"criteria": "cpe:2.3:a:owncloud:owncloud_server:5.0.14:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A24E2C3B-6585-482B-920B-B41B892B8D99"
},
{
"criteria": "cpe:2.3:a:phpexcel_project:phpexcel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "3F54EA98-9036-41FD-B69C-8B2FA7D07E3B",
"versionEndIncluding": "1.7.9"
}
],
"operator": "OR"
}
]
}
],
"evaluatorComment": "Per: http://cwe.mitre.org/data/definitions/611.html\n\n\"CWE-611: Improper Restriction of XML External Entity Reference ('XXE')\"",
"sourceIdentifier": "cve@mitre.org"
}