CVE-2024-3044: fallo de gravedad media en The Document Foundation LibreOffice
Graphic on-click binding allows unchecked script execution
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 6.5epss 1.0%
Unchecked script execution in Graphic on-click binding in affected LibreOffice versions allows an attacker to create a document which without prompt will execute scripts built-into LibreOffice on clicking a graphic. Such scripts were previously deemed trusted but are now deemed untrusted.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Productos afectados
The Document Foundation · LibreOfficeCVEs relacionadas — The Document Foundation LibreOffice
En el mismo producto, de las más peligrosas a las menos.
CVE-2022-3140—Macro URL arbitrary script executionEPSS 7.0%CVE-2021-25631—denylist of executable filename extensions possible to bypass under windowsEPSS 5.0%CVE-2023-2255—Remote documents loaded without prompt via IFrameEPSS 2.2%CVE-2020-12802—remote graphics contained in docx format retrieved in 'stealth mode'EPSS 2.0%CVE-2020-12803—XForms submissions could overwrite local filesEPSS 1.8%CVE-2022-26307—Weak Master KeysEPSS 1.5%