QwikSec

Security Database

CVE

CWE

Training

CVE Database
/

CVE-2018-16858

Back to search

CVE-2018-16858

Published: Mar 25, 2019

Modified: Aug 5, 2024

PUBLISHED

CVSS v3.0

7.8

HIGH

Description

It was found that libreoffice before versions 6.0.7 and 6.1.3 was vulnerable to a directory traversal attack which could be used to execute arbitrary macros bundled with a document. An attacker could craft a document, which when opened by LibreOffice, would execute a Python method from a script in any arbitrary file system location, specified relative to the LibreOffice install location.

VendorProductVersions

[UNKNOWN]

libreoffice

affected
6.0.7
affected
6.1.3

Weaknesses (CWE)

CWE-356

CVSS v3.0 Details

CVSS v3.0 Vector

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

References

46727
exploit
x_refsource_EXPLOIT-DB
RHSA-2019:2130
vendor-advisory
x_refsource_REDHAT
openSUSE-SU-2019:1929
vendor-advisory
x_refsource_SUSE

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Start Training

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.

Scan Now