Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2024-30265

Good to know:

icon
icon

Date: April 3, 2024

Collabora Online is a collaborative online office suite based on LibreOffice technology. Any deployment of voilà dashboard allow local file inclusion. Any file on a filesystem that is readable by the user that runs the voilà dashboard server can be downloaded by someone with network access to the server. Whether this still requires authentication depends on how voilà is deployed. This issue has been patched in 0.2.17, 0.3.8, 0.4.4 and 0.5.6.

Language: Python

Severity Score

Related Resources (9)

https://github.com/voila-dashboards/voila/commit/5542e4ae36bb5d184deaa48f95e76be477756af2
https://github.com/voila-dashboards/voila
https://github.com/voila-dashboards/voila/commit/98b6a40fec27723572314fdbba99bdc147d904c8
https://github.com/voila-dashboards/voila/security/advisories/GHSA-2q59-h24c-w6fg
https://github.com/voila-dashboards/voila/commit/28faacc9b03b160fd8fa920ad045f4ec0667ab67
https://nvd.nist.gov/vuln/detail/CVE-2024-30265
https://github.com/voila-dashboards/voila/commit/c045be6988539d07cceeb9f82fc660a49485d504
https://github.com/voila-dashboards/voila/commit/00d6362c237b6b4d466873535554d6076ead0c52
https://www.mend.io/vulnerability-database/CVE-2024-30265

Severity Score

Weakness Type (CWE)

External Control of File Name or Path

CWE-73

Top Fix

icon

Upgrade Version

Upgrade to version voila - 0.2.17;voila - 0.3.8;voila - 0.4.4;voila - 0.5.6

Learn More

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): LOW
Privileges Required (PR): NONE
User Interaction (UI): NONE
Scope (S): UNCHANGED
Confidentiality (C): HIGH
Integrity (I): NONE
Availability (A): NONE

Do you need more information?

Contact Us