VulnerabilityAnalyzed
CVE-2024-3044
Unchecked script execution in Graphic on-click binding in affected LibreOffice versions allows an attacker to create a document which without prompt will execute scripts built-into LibreOffice on clicking a graphic.
MEDIUM 6.5EPSS 1.01%
Does this matter?
Lower severity and a low EPSS score (1.01%). Track it; it rarely justifies an emergency change on its own.
Description
Unchecked script execution in Graphic on-click binding in affected LibreOffice versions allows an attacker to create a document which without prompt will execute scripts built-into LibreOffice on clicking a graphic. Such scripts were previously deemed trusted but are now deemed untrusted.
- CVSS 3.1
- 6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
- EPSS
- 1.01% probability · 61th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-356, CWE-94
- Affected
- libreoffice/libreoffice · fedoraproject/fedora · debian/debian linux
- Source
- security@documentfoundation.org
References
- https://lists.debian.org/debian-lts-announce/2024/05/msg00016.htmlMailing List, Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3TU3TYDXICKPYHMCNL7ARYYBXACEAYJ4/Mailing List, Third Party Advisory
- https://www.libreoffice.org/about-us/security/advisories/CVE-2024-3044Vendor Advisory
- https://lists.debian.org/debian-lts-announce/2024/05/msg00016.htmlMailing List, Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3TU3TYDXICKPYHMCNL7ARYYBXACEAYJ4/Mailing List, Third Party Advisory
- https://www.libreoffice.org/about-us/security/advisories/CVE-2024-3044Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.