Description (CNA)
URLs could be constructed which expanded environment variable or INI file values, so potentially sensitive information could be exfiltrated to a remote server on opening a document containing such links. The check added for CVE-2024-12426 did not recognise every way of naming the package content provider, so a URL that named it differently still reached the expansion. In fixed versions the package content provider is matched when the URL is checked.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| The Document Foundation / LibreOffice | affected 26.2 before < 26.2.5 |
CWE
CWE-200
References
ADP enrichment
No English description supplied.
No references supplied.