CVE-2024-30265CWE-73

Voilà Local file inclusion

High · published April 3, 2024

CVSS v3.1
7.5
EPSS
1%
Percentile
53.6
In the wild
Unconfirmed
What it is

Collabora Online is a collaborative online office suite based on LibreOffice technology. Any deployment of voilà dashboard allow local file inclusion. Any file on a filesystem that is readable by the user that runs the voilà dashboard server can be downloaded by someone with network access to the server. Whether this still requires authentication depends on how voilà is deployed. This issue has been patched in 0.2.17, 0.3.8, 0.4.4 and 0.5.6.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00725 · 53.6th percentile
Weakness
CWE-73 · External Control of File Name or Path
Published
2024-04-03T22:55Z
EPSS history
Timeline
  • 03 APR 22:55Z
    Voilà Local file inclusion
    cvelistv5