CVE-2024-25114: Sensitive Information Disclosure (JailID) to users in Collabora Online
Collabora Online is a collaborative online office suite based on LibreOffice technology. Each document in Collabora Online is opened by a separate "Kit" instance in a different "jail" with a unique directory "jailID" name. For security reasons, this directory name is randomly generated and should not be given out to the client. In affected versions of Collabora Online it is possible to use the CELL() function, with the "filename" argument, in the spreadsheet component to get a path which includes this JailID. The impact of this vulnerability in its own is low because it requires to be chained with another vulnerability. Users should upgrade to Collabora Online 23.05.9; Collabora Online 22.05.22; Collabora Online 21.11.10 or higher. There are no known workarounds for this vulnerability.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-25114?
CVE-2024-25114 is categorized as a high-severity vulnerability affecting specific versions of Collabora Online.
How do I fix CVE-2024-25114?
To mitigate CVE-2024-25114, upgrade to a patched version of Collabora Online that addresses this vulnerability.
What versions of Collabora Online are affected by CVE-2024-25114?
Collabora Online versions up to 23.05.9, 22.05.22, and 21.11.10 are affected by CVE-2024-25114.
What is the impact of CVE-2024-25114?
CVE-2024-25114 may allow unauthorized access or manipulation of documents in Collabora Online.
Is there any workaround for CVE-2024-25114?
Currently, there are no documented workarounds for CVE-2024-25114; upgrading is the recommended action.