PT-2024-27470 · Collabora · Collabora Online

Caolanm · Published 2024-08-23 · Updated 2024-08-27 · CVE-2024-37311

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions Collabora Online versions prior to 22.05.23.1 Collabora Online versions prior to 23.05.14.1 Collabora Online versions prior to 24.04.4.3

Description In affected versions of Collabora Online, a collaborative online office suite based on LibreOffice, https connections from coolwsd to other hosts may incompletely verify the remote host's certificate against the full chain of trust.

Recommendations For versions prior to 22.05.23.1, update to version 22.05.23.1 or later. For versions prior to 23.05.14.1, update to version 23.05.14.1 or later. For versions prior to 24.04.4.3, update to version 24.04.4.3 or later.

Exploit

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

CVE-2024-37311

GHSA-HVHM-5C44-977X

Affected Products

Collabora Online

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/37xxx/CVE-2024-37311.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-37311 · Security Note
• https://osv.dev/vulnerability/CVE-2024-37311 · Vendor Advisory
• https://github.com/CollaboraOnline/online/security/advisories/GHSA-hvhm-5c44-977x · Note
• https://twitter.com/VulmonFeeds/status/1827030969817112576 · Twitter Post
• https://t.me/cvedetector/4003 · Telegram Post
• https://twitter.com/cracbot/status/1828673942137294939 · Twitter Post
• https://twitter.com/cracbot/status/1828311614577168749 · Twitter Post
• https://twitter.com/CVEnew/status/1826995683036930540 · Twitter Post