CVE-2024-6472CWE-295

Ability to trust not validated macro signatures removed in high security mode

High · published August 5, 2024

CVSS v3.1
7.8
EPSS
0%
Percentile
14.0
In the wild
Unconfirmed
What it is

Certificate Validation user interface in LibreOffice allows potential vulnerability.

Signed macros are scripts that have been digitally signed by the

developer using a cryptographic signature. When a document with a signed

macro is opened a warning is displayed by LibreOffice before the macro

is executed.

Previously if verification failed the user could fail to understand the failure and choose to enable the macros anyway.

This issue affects LibreOffice: from 24.2 before 24.2.5.

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00238 · 14.0th percentile
Weakness
CWE-295 · Improper Certificate Validation
Published
2024-08-05T12:55Z
EPSS history
Timeline
  • 05 AUG 12:55Z
    Ability to trust not validated macro signatures removed in high security mode
    cvelistv5