CVE-2019-9852CWE-116

CVE-2019-9852: falha em Document Foundation LibreOffice

Insufficient URL encoding flaw in allowed script location check

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar LibreOffice+ Monitorar libreoffice

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

3Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackepss 1.8%
LibreOffice has a feature where documents can specify that pre-installed macros can be executed on various script events such as mouse-over, document-open etc. Access is intended to be restricted to scripts under the share/Scripts/python, user/Scripts/python sub-directories of the LibreOffice install. Protection was added, to address CVE-2018-16858, to avoid a directory traversal attack where scripts in arbitrary locations on the file system could be executed. However this new protection could be bypassed by a URL encoding attack. In the fixed versions, the parsed url describing the script location is correctly encoded before further processing. This issue affects: Document Foundation LibreOffice versions prior to 6.2.6.
Produtos afetados
Document Foundation · LibreOffice
CVEs relacionadas — Document Foundation LibreOffice

No mesmo produto, das mais perigosas para as menos.

CVE-2019-9851—LibreLogo global-event script executionEPSS 77.8%CVE-2019-9848—CVE-2019-9848EPSS 28.9%CVE-2019-9853—Insufficient URL decoding flaw in categorizing macro locationEPSS 3.1%CVE-2019-9855—Windows 8.3 path equivalence handling flaw allows LibreLogo script executionEPSS 3.0%CVE-2019-9850—Insufficient url validation allowing LibreLogo script executionEPSS 2.9%CVE-2019-9849—CVE-2019-9849EPSS 2.6%