PT-2019-6306 · Libreoffice+3 · Unoconv+3
Brett Buerhaus
+6
·
Publicado
2019-09-16
·
Atualizado
2020-10-20
·
CVE-2019-17400
CVSS v4.0
8.7
Alta
| Vetor | AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
unoconv versions prior to 0.9
Description
The issue is related to insufficient validation of incoming requests in the LibreOffice Unoconv document format converter. This allows a remote attacker to access confidential data. The vulnerability is also associated with the mishandling of untrusted pathnames, leading to Server-Side Request Forgery (SSRF) and local file inclusion.
Recommendations
For versions prior to 0.9, update to version 0.9 or later to resolve the issue. As a temporary workaround, consider restricting access to the unoconv package to minimize the risk of exploitation. Avoid using untrusted pathnames in the affected package until the issue is resolved.
Exploit
Correção
SSRF
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Astra Linux
Centos
Red Hat
Unoconv