CVE-2020-13451 - An incomplete-cleanup vulnerability in the Office rendering engine of Gotenberg through 6.2.1 allows an attacker to overwrite LibreOffice configuration files and execute arbitrary code via macros

Back Back to CVE browser

CRITICAL

An incomplete-cleanup vulnerability in the Office rendering engine of Gotenberg through 6.2.1 allows an attacker to overwrite LibreOffice configuration files and execute arbitrary code via macros

Published Jan 7, 2021

9.8

CRITICAL

CVSS 3.1

EPSS 3.15%

Description

An incomplete-cleanup vulnerability in the Office rendering engine of Gotenberg through 6.2.1 allows an attacker to overwrite LibreOffice configuration files and execute arbitrary code via macros.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-459

References (3)

http://packetstormsecurity.com/files/160744/Gotenberg-6.2.0-Traversal-Code-Execution-Insecure-Permissions.html
x_refsource_MISCExploitThird Party AdvisoryVDB Entry
https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-5704
Advisory
https://github.com/thecodingmachine/gotenberg/issues/199
x_refsource_MISCThird Party Advisory

Link	Providers	Tags
http://packetstormsecurity.com/files/160744/Gotenberg-6.2.0-Traversal-Code-Execution-Insecure-Permissions.html		x_refsource_MISCExploitThird Party AdvisoryVDB Entry
https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-5704		Advisory
https://github.com/thecodingmachine/gotenberg/issues/199		x_refsource_MISCThird Party Advisory