Voilà Local file inclusion
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 0.2.17, 0.3.8, 0.4.4, 0.5.6
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: no
- Technical impact: partial
Summary
Collabora Online is a collaborative online office suite based on LibreOffice technology. Any deployment of voilà dashboard allow local file inclusion. Any file on a filesystem that is readable by the user that runs the voilà dashboard server can be downloaded by someone with network access to the server. Whether this still requires authentication depends on how voilà is deployed. This issue has been patched in 0.2.17, 0.3.8, 0.4.4 and 0.5.6.
Timeline
- CVE published
- CISA SSVC assessment
Exploitation: none · Automatable: no · Technical impact: partial
- Record last updated
Affected versions
- voila-dashboards voila
From 0.0.2 · fixed in 0.2.17; From 0.3.0a0 · fixed in 0.3.8; From 0.4.0a0 · fixed in 0.4.4; From 0.5.0a0 · fixed in 0.5.6
- voilaPyPI
From 0.0.2 · fixed in 0.2.17; From 0.3.0a0 · fixed in 0.3.8; From 0.4.0a0 · fixed in 0.4.4; From 0.5.0a0 · fixed in 0.5.6
- voilaPyPI
From 0.0.2 · fixed in 0.2.17
- voilaPyPI
From 0.3.0a0 · fixed in 0.3.8
- voilaPyPI
From 0.4.0a0 · fixed in 0.4.4
- voilaPyPI
From 0.5.0a0 · fixed in 0.5.6