Back

CVE-2024-6472

Aug. 5, 2024, 1:15 p.m.

Received
CVE has been recently published to the CVE List and has been received by the NVD.

Products

LibreOffice

  • 24.2
  • before 24.2.5

Source

security@documentfoundation.org

Tags

CWE-295
security@documentfoundation.org
2024-08-05
CVE-2024-6472

CVE-2024-6472 details

Published : Aug. 5, 2024, 1:15 p.m.
Last Modified : Aug. 5, 2024, 1:15 p.m.

Description

Certificate Validation user interface in LibreOffice allows potential vulnerability. Signed macros are scripts that have been digitally signed by the developer using a cryptographic signature. When a document with a signed macro is opened a warning is displayed by LibreOffice before the macro is executed. Previously if verification failed the user could fail to understand the failure and choose to enable the macros anyway. This issue affects LibreOffice: from 24.2 before 24.2.5.

CVSS Score

1 2 3 4 5 6 7.8 8 9 10

Weakness

Weakness Name Description
CWE-295 Improper Certificate Validation The product does not validate, or incorrectly validates, a certificate.

CVSS Data

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

Base Score

7.8

Exploitability Score

1.8

Impact Score

5.9

Base Severity

HIGH

Vector String : CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References

URL Source
https://www.libreoffice.org/about-us/security/advisories/CVE-2024-6472 security@documentfoundation.org
This website uses the NVD API, but is not approved or certified by it.