CVE-2020-12802CWE-200

CVE-2020-12802: fallo en The Document Foundation LibreOffice

remote graphics contained in docx format retrieved in 'stealth mode'

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear LibreOffice+ Monitorear libreoffice

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

3Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackepss 2.0%
LibreOffice has a 'stealth mode' in which only documents from locations deemed 'trusted' are allowed to retrieve remote resources. This mode is not the default mode, but can be enabled by users who want to disable LibreOffice's ability to include remote resources within a document. A flaw existed where remote graphic links loaded from docx documents were omitted from this protection prior to version 6.4.4. This issue affects: The Document Foundation LibreOffice versions prior to 6.4.4.
Productos afectados
The Document Foundation · LibreOffice
CVEs relacionadas — The Document Foundation LibreOffice

En el mismo producto, de las más peligrosas a las menos.

CVE-2022-3140—Macro URL arbitrary script executionEPSS 7.0%CVE-2021-25631—denylist of executable filename extensions possible to bypass under windowsEPSS 5.0%CVE-2023-2255—Remote documents loaded without prompt via IFrameEPSS 2.2%CVE-2020-12803—XForms submissions could overwrite local filesEPSS 1.8%CVE-2022-26307—Weak Master KeysEPSS 1.5%CVE-2020-12801—Crash-recovered MSOffice encrypted documents defaulted to not to using encryption on next saveEPSS 1.3%