PT-2024-23308 · Collabora · Collabora Online Voilà Dashboard

Ericfinger · Published 2024-04-03 · Updated 2024-04-04 · CVE-2024-30265

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Collabora Online voilà dashboard versions prior to 0.2.17 Collabora Online voilà dashboard versions prior to 0.3.8 Collabora Online voilà dashboard versions prior to 0.4.4 Collabora Online voilà dashboard versions prior to 0.5.6

Description The issue allows local file inclusion, enabling the download of any file on the filesystem that is readable by the user running the voilà dashboard server by someone with network access to the server. Whether authentication is required depends on the deployment of voilà. Multiple voilà instances online are impacted.

Recommendations For versions prior to 0.2.17, update to version 0.2.17 or later. For versions prior to 0.3.8, update to version 0.3.8 or later. For versions prior to 0.4.4, update to version 0.4.4 or later. For versions prior to 0.5.6, update to version 0.5.6 or later. As a temporary workaround, consider restricting access to the "/static" route until a patch is available. Restrict access to sensitive files on the filesystem to minimize the risk of exploitation.

Exploit

Fix

Weakness Enumeration

CWE-73

Related Identifiers

CVE-2024-30265

GHSA-2Q59-H24C-W6FG

Affected Products

Collabora Online Voilà Dashboard

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/30xxx/CVE-2024-30265.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-30265 · Security Note
• https://osv.dev/vulnerability/CVE-2024-30265 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-2q59-h24c-w6fg · Vendor Advisory
• https://github.com/voila-dashboards/voila/commit/98b6a40fec27723572314fdbba99bdc147d904c8 · Note
• https://github.com/voila-dashboards/voila/commit/5542e4ae36bb5d184deaa48f95e76be477756af2 · Note
• https://github.com/voila-dashboards/voila/security/advisories/GHSA-2q59-h24c-w6fg · Note
• https://github.com/voila-dashboards/voila/commit/c045be6988539d07cceeb9f82fc660a49485d504 · Note
• https://github.com/voila-dashboards/voila/commit/28faacc9b03b160fd8fa920ad045f4ec0667ab67 · Note
• https://github.com/voila-dashboards/voila/commit/00d6362c237b6b4d466873535554d6076ead0c52 · Note
• https://github.com/voila-dashboards/voila · Note
• https://t.me/cvenotify/75672 · Telegram Post