« Volver al listado

CVE-2024-37311

Estado: AplazadaAlta (8.2)—

Collabora Online is a collaborative online office suite based on LibreOffice. In affected versions of Collabora Online, https connections from coolwsd to other hosts may incompletely verify the remote host's certificate's against the full chain of trust. This vulnerability is fixed in Collabora Online 24.04.4.3, 23.05.14.1, and 22.05.23.1.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Collabora — OnlineAILibreoffice — LibreofficeAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-37311",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-37311",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-08-23T16:11:47.343263Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.2,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 4.2,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "CollaboraOnline",
          "product": "online",
          "versions": [
            {
              "status": "affected",
              "version": ">= 24.04.1.1, < 24.04.4.3"
            },
            {
              "status": "affected",
              "version": ">= 23.05.0-1, < 23.05.14-1"
            },
            {
              "status": "affected",
              "version": "< 22.05.23.1"
            }
          ]
        }
      ]
    }
  ],
  "published": "2024-08-23T15:15:15.617",
  "references": [
    {
      "url": "https://github.com/CollaboraOnline/online/security/advisories/GHSA-hvhm-5c44-977x",
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-295"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Collabora Online is a collaborative online office suite based on LibreOffice. In affected versions of Collabora Online, https connections from coolwsd to other hosts may incompletely verify the remote host's certificate's against the full chain of trust. This vulnerability is fixed in Collabora Online 24.04.4.3, 23.05.14.1, and 22.05.23.1."
    },
    {
      "lang": "es",
      "value": "Collabora Online es una suite ofimática colaborativa en línea basada en LibreOffice. En las versiones afectadas de Collabora Online, las conexiones https de coolwsd a otros hosts pueden verificar de forma incompleta los certificados del host remoto con respecto a la cadena de confianza completa. Esta vulnerabilidad se solucionó en Collabora Online 24.04.4.3, 23.05.14.1 y 22.05.23.1."
    }
  ],
  "lastModified": "2026-06-17T07:38:07.203",
  "sourceIdentifier": "security-advisories@github.com"
}