CVE - CVE-2024-30265

CVE-ID
CVE-2024-30265	Learn more at National Vulnerability Database (NVD) • CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information
Description
Collabora Online is a collaborative online office suite based on LibreOffice technology. Any deployment of voilà dashboard allow local file inclusion. Any file on a filesystem that is readable by the user that runs the voilà dashboard server can be downloaded by someone with network access to the server. Whether this still requires authentication depends on how voilà is deployed. This issue has been patched in 0.2.17, 0.3.8, 0.4.4 and 0.5.6.
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
MISC:https://github.com/voila-dashboards/voila/commit/00d6362c237b6b4d466873535554d6076ead0c52 URL:https://github.com/voila-dashboards/voila/commit/00d6362c237b6b4d466873535554d6076ead0c52 MISC:https://github.com/voila-dashboards/voila/commit/28faacc9b03b160fd8fa920ad045f4ec0667ab67 URL:https://github.com/voila-dashboards/voila/commit/28faacc9b03b160fd8fa920ad045f4ec0667ab67 MISC:https://github.com/voila-dashboards/voila/commit/5542e4ae36bb5d184deaa48f95e76be477756af2 URL:https://github.com/voila-dashboards/voila/commit/5542e4ae36bb5d184deaa48f95e76be477756af2 MISC:https://github.com/voila-dashboards/voila/commit/98b6a40fec27723572314fdbba99bdc147d904c8 URL:https://github.com/voila-dashboards/voila/commit/98b6a40fec27723572314fdbba99bdc147d904c8 MISC:https://github.com/voila-dashboards/voila/commit/c045be6988539d07cceeb9f82fc660a49485d504 URL:https://github.com/voila-dashboards/voila/commit/c045be6988539d07cceeb9f82fc660a49485d504 MISC:https://github.com/voila-dashboards/voila/security/advisories/GHSA-2q59-h24c-w6fg URL:https://github.com/voila-dashboards/voila/security/advisories/GHSA-2q59-h24c-w6fg
Assigning CNA
GitHub (maintainer security advisories)
Date Record Created
20240326	Disclaimer: The record creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Assigned (20240326)
Votes (Legacy)

Comments (Legacy)

Proposed (Legacy)
N/A
This is an record on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.
Search CVE Using Keywords: You can also search by reference using the CVE Reference Maps.
For More Information: CVE Request Web Form (select "Other" from dropdown)