CVE-2018-16858CWE-356

It was found that libreoffice before versions 6.0.7 and 6.1.3 was vulnerable to a directory traversal attack which could be used to execute arbitrary macros…

High · published March 25, 2019

Patch now

High probability of exploitation

CVSS calls it high at 7.8. It sits in the 99.3th percentile for exploit probability.

CVSS v3.0
7.8
EPSS
67%
Percentile
99.3
In the wild
Unconfirmed
What it is

It was found that libreoffice before versions 6.0.7 and 6.1.3 was vulnerable to a directory traversal attack which could be used to execute arbitrary macros bundled with a document. An attacker could craft a document, which when opened by LibreOffice, would execute a Python method from a script in any arbitrary file system location, specified relative to the LibreOffice install location.

The record
Technical detail
CVSS v3.0
7.8 · HIGH
Vector
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.67321 · 99.3th percentile
Weakness
CWE-356 · Product UI does not Warn User of Unsafe Actions
Published
2019-03-25T17:43Z
EPSS history
Timeline
  • 25 MAR 17:43Z
    It was found that libreoffice before versions 6.0.7 and 6.1.3 was vulnerable to a directory traversal attack which could be used to execute arbitrary macros…
    cvelistv5