CVE-2024-30265 - OpenCVE

Collabora Online is a collaborative online office suite based on LibreOffice technology. Any deployment of voilà dashboard allow local file inclusion. Any file on a filesystem that is readable by the user that runs the voilà dashboard server can be downloaded by someone with network access to the server. Whether this still requires authentication depends on how voilà is deployed. This issue has been patched in 0.2.17, 0.3.8, 0.4.4 and 0.5.6.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

No data.

No data.

No data.

References

Link	Providers
https://github.com/voila-dashboards/voila/commit/00d6362c237b6b4d466873535554d6076ead0c52
https://github.com/voila-dashboards/voila/commit/28faacc9b03b160fd8fa920ad045f4ec0667ab67
https://github.com/voila-dashboards/voila/commit/5542e4ae36bb5d184deaa48f95e76be477756af2
https://github.com/voila-dashboards/voila/commit/98b6a40fec27723572314fdbba99bdc147d904c8
https://github.com/voila-dashboards/voila/commit/c045be6988539d07cceeb9f82fc660a49485d504
https://github.com/voila-dashboards/voila/security/advisories/GHSA-2q59-h24c-w6fg

History

No history.

MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published: 2024-04-03T22:55:20.202Z

Updated: 2024-08-02T01:32:06.621Z

Reserved: 2024-03-26T12:52:00.935Z

Link: CVE-2024-30265

Vulnrichment

Updated: 2024-08-02T01:32:06.621Z

NVD

Status : Awaiting Analysis

Published: 2024-04-03T23:15:13.423

Modified: 2024-04-04T12:48:41.700

Link: CVE-2024-30265

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-30265", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2024-03-26T12:52:00.935Z", "datePublished": "2024-04-03T22:55:20.202Z", "dateUpdated": "2024-08-02T01:32:06.621Z"}, "containers": {"cna": {"title": "Voil\u00e0 Local file inclusion", "problemTypes": [{"descriptions": [{"cweId": "CWE-73", "lang": "en", "description": "CWE-73: External Control of File Name or Path", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/voila-dashboards/voila/security/advisories/GHSA-2q59-h24c-w6fg", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/voila-dashboards/voila/security/advisories/GHSA-2q59-h24c-w6fg"}, {"name": "https://github.com/voila-dashboards/voila/commit/00d6362c237b6b4d466873535554d6076ead0c52", "tags": ["x_refsource_MISC"], "url": "https://github.com/voila-dashboards/voila/commit/00d6362c237b6b4d466873535554d6076ead0c52"}, {"name": "https://github.com/voila-dashboards/voila/commit/28faacc9b03b160fd8fa920ad045f4ec0667ab67", "tags": ["x_refsource_MISC"], "url": "https://github.com/voila-dashboards/voila/commit/28faacc9b03b160fd8fa920ad045f4ec0667ab67"}, {"name": "https://github.com/voila-dashboards/voila/commit/5542e4ae36bb5d184deaa48f95e76be477756af2", "tags": ["x_refsource_MISC"], "url": "https://github.com/voila-dashboards/voila/commit/5542e4ae36bb5d184deaa48f95e76be477756af2"}, {"name": "https://github.com/voila-dashboards/voila/commit/98b6a40fec27723572314fdbba99bdc147d904c8", "tags": ["x_refsource_MISC"], "url": "https://github.com/voila-dashboards/voila/commit/98b6a40fec27723572314fdbba99bdc147d904c8"}, {"name": "https://github.com/voila-dashboards/voila/commit/c045be6988539d07cceeb9f82fc660a49485d504", "tags": ["x_refsource_MISC"], "url": "https://github.com/voila-dashboards/voila/commit/c045be6988539d07cceeb9f82fc660a49485d504"}], "affected": [{"vendor": "voila-dashboards", "product": "voila", "versions": [{"version": ">= 0.0.2, < 0.2.17", "status": "affected"}, {"version": ">= 0.3.0a0, < 0.3.8", "status": "affected"}, {"version": ">= 0.4.0a0, < 0.4.4", "status": "affected"}, {"version": ">= 0.5.0a0, < 0.5.6", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2024-04-03T22:55:20.202Z"}, "descriptions": [{"lang": "en", "value": "Collabora Online is a collaborative online office suite based on LibreOffice technology. Any deployment of voil\u00e0 dashboard allow local file inclusion. Any file on a filesystem that is readable by the user that runs the voil\u00e0 dashboard server can be downloaded by someone with network access to the server. Whether this still requires authentication depends on how voil\u00e0 is deployed. This issue has been patched in 0.2.17, 0.3.8, 0.4.4 and 0.5.6.\n"}], "source": {"advisory": "GHSA-2q59-h24c-w6fg", "discovery": "UNKNOWN"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-30265", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-04-04T16:07:37.511255Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-04T17:39:46.558Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T01:32:06.621Z"}, "title": "CVE Program Container", "references": [{"name": "https://github.com/voila-dashboards/voila/security/advisories/GHSA-2q59-h24c-w6fg", "tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/voila-dashboards/voila/security/advisories/GHSA-2q59-h24c-w6fg"}, {"name": "https://github.com/voila-dashboards/voila/commit/00d6362c237b6b4d466873535554d6076ead0c52", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/voila-dashboards/voila/commit/00d6362c237b6b4d466873535554d6076ead0c52"}, {"name": "https://github.com/voila-dashboards/voila/commit/28faacc9b03b160fd8fa920ad045f4ec0667ab67", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/voila-dashboards/voila/commit/28faacc9b03b160fd8fa920ad045f4ec0667ab67"}, {"name": "https://github.com/voila-dashboards/voila/commit/5542e4ae36bb5d184deaa48f95e76be477756af2", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/voila-dashboards/voila/commit/5542e4ae36bb5d184deaa48f95e76be477756af2"}, {"name": "https://github.com/voila-dashboards/voila/commit/98b6a40fec27723572314fdbba99bdc147d904c8", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/voila-dashboards/voila/commit/98b6a40fec27723572314fdbba99bdc147d904c8"}, {"name": "https://github.com/voila-dashboards/voila/commit/c045be6988539d07cceeb9f82fc660a49485d504", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/voila-dashboards/voila/commit/c045be6988539d07cceeb9f82fc660a49485d504"}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://github.com/voila-dashboards/voila/security/advisories/GHSA-2q59-h24c-w6fg", "name": "https://github.com/voila-dashboards/voila/security/advisories/GHSA-2q59-h24c-w6fg", "tags": ["x_refsource_CONFIRM", "x_transferred"]}, {"url": "https://github.com/voila-dashboards/voila/commit/00d6362c237b6b4d466873535554d6076ead0c52", "name": "https://github.com/voila-dashboards/voila/commit/00d6362c237b6b4d466873535554d6076ead0c52", "tags": ["x_refsource_MISC", "x_transferred"]}, {"url": "https://github.com/voila-dashboards/voila/commit/28faacc9b03b160fd8fa920ad045f4ec0667ab67", "name": "https://github.com/voila-dashboards/voila/commit/28faacc9b03b160fd8fa920ad045f4ec0667ab67", "tags": ["x_refsource_MISC", "x_transferred"]}, {"url": "https://github.com/voila-dashboards/voila/commit/5542e4ae36bb5d184deaa48f95e76be477756af2", "name": "https://github.com/voila-dashboards/voila/commit/5542e4ae36bb5d184deaa48f95e76be477756af2", "tags": ["x_refsource_MISC", "x_transferred"]}, {"url": "https://github.com/voila-dashboards/voila/commit/98b6a40fec27723572314fdbba99bdc147d904c8", "name": "https://github.com/voila-dashboards/voila/commit/98b6a40fec27723572314fdbba99bdc147d904c8", "tags": ["x_refsource_MISC", "x_transferred"]}, {"url": "https://github.com/voila-dashboards/voila/commit/c045be6988539d07cceeb9f82fc660a49485d504", "name": "https://github.com/voila-dashboards/voila/commit/c045be6988539d07cceeb9f82fc660a49485d504", "tags": ["x_refsource_MISC", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T01:32:06.621Z"}}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-30265", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-04-04T16:07:37.511255Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-05-23T19:01:22.094Z"}, "title": "CISA ADP Vulnrichment"}], "cna": {"title": "Voil\u00e0 Local file inclusion", "source": {"advisory": "GHSA-2q59-h24c-w6fg", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "voila-dashboards", "product": "voila", "versions": [{"status": "affected", "version": ">= 0.0.2, < 0.2.17"}, {"status": "affected", "version": ">= 0.3.0a0, < 0.3.8"}, {"status": "affected", "version": ">= 0.4.0a0, < 0.4.4"}, {"status": "affected", "version": ">= 0.5.0a0, < 0.5.6"}]}], "references": [{"url": "https://github.com/voila-dashboards/voila/security/advisories/GHSA-2q59-h24c-w6fg", "name": "https://github.com/voila-dashboards/voila/security/advisories/GHSA-2q59-h24c-w6fg", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/voila-dashboards/voila/commit/00d6362c237b6b4d466873535554d6076ead0c52", "name": "https://github.com/voila-dashboards/voila/commit/00d6362c237b6b4d466873535554d6076ead0c52", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/voila-dashboards/voila/commit/28faacc9b03b160fd8fa920ad045f4ec0667ab67", "name": "https://github.com/voila-dashboards/voila/commit/28faacc9b03b160fd8fa920ad045f4ec0667ab67", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/voila-dashboards/voila/commit/5542e4ae36bb5d184deaa48f95e76be477756af2", "name": "https://github.com/voila-dashboards/voila/commit/5542e4ae36bb5d184deaa48f95e76be477756af2", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/voila-dashboards/voila/commit/98b6a40fec27723572314fdbba99bdc147d904c8", "name": "https://github.com/voila-dashboards/voila/commit/98b6a40fec27723572314fdbba99bdc147d904c8", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/voila-dashboards/voila/commit/c045be6988539d07cceeb9f82fc660a49485d504", "name": "https://github.com/voila-dashboards/voila/commit/c045be6988539d07cceeb9f82fc660a49485d504", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Collabora Online is a collaborative online office suite based on LibreOffice technology. Any deployment of voil\u00e0 dashboard allow local file inclusion. Any file on a filesystem that is readable by the user that runs the voil\u00e0 dashboard server can be downloaded by someone with network access to the server. Whether this still requires authentication depends on how voil\u00e0 is deployed. This issue has been patched in 0.2.17, 0.3.8, 0.4.4 and 0.5.6.\n"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-73", "description": "CWE-73: External Control of File Name or Path"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2024-04-03T22:55:20.202Z"}}}, "cveMetadata": {"cveId": "CVE-2024-30265", "state": "PUBLISHED", "dateUpdated": "2024-08-02T01:32:06.621Z", "dateReserved": "2024-03-26T12:52:00.935Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2024-04-03T22:55:20.202Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.1"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "Collabora Online is a collaborative online office suite based on LibreOffice technology. Any deployment of voil\u00e0 dashboard allow local file inclusion. Any file on a filesystem that is readable by the user that runs the voil\u00e0 dashboard server can be downloaded by someone with network access to the server. Whether this still requires authentication depends on how voil\u00e0 is deployed. This issue has been patched in 0.2.17, 0.3.8, 0.4.4 and 0.5.6.\n"}, {"lang": "es", "value": "Collabora Online es una suite ofim\u00e1tica colaborativa en l\u00ednea basada en la tecnolog\u00eda LibreOffice. Cualquier implementaci\u00f3n del panel voil\u00e0 permite la inclusi\u00f3n de archivos locales. Cualquier archivo en un sistema de archivos que sea legible por el usuario que ejecuta el servidor del panel voil\u00e0 puede ser descargado por alguien con acceso de red al servidor. Si esto todav\u00eda requiere autenticaci\u00f3n depende de c\u00f3mo se implemente voil\u00e0. Este problema se solucion\u00f3 en 0.2.17, 0.3.8, 0.4.4 y 0.5.6."}], "id": "CVE-2024-30265", "lastModified": "2024-04-04T12:48:41.700", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}]}, "published": "2024-04-03T23:15:13.423", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/voila-dashboards/voila/commit/00d6362c237b6b4d466873535554d6076ead0c52"}, {"source": "security-advisories@github.com", "url": "https://github.com/voila-dashboards/voila/commit/28faacc9b03b160fd8fa920ad045f4ec0667ab67"}, {"source": "security-advisories@github.com", "url": "https://github.com/voila-dashboards/voila/commit/5542e4ae36bb5d184deaa48f95e76be477756af2"}, {"source": "security-advisories@github.com", "url": "https://github.com/voila-dashboards/voila/commit/98b6a40fec27723572314fdbba99bdc147d904c8"}, {"source": "security-advisories@github.com", "url": "https://github.com/voila-dashboards/voila/commit/c045be6988539d07cceeb9f82fc660a49485d504"}, {"source": "security-advisories@github.com", "url": "https://github.com/voila-dashboards/voila/security/advisories/GHSA-2q59-h24c-w6fg"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-73"}], "source": "security-advisories@github.com", "type": "Secondary"}]}