CVEvulnerability
CVE-2021-25631
8.8 HIGH
Official page ↗
- Status
- Modified
- Published
- 2021-05-03
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 9.3 HIGH — AV:N/AC:M/Au:N/C:C/I:C/A:C
- Weaknesses
- CWE-184
Description
In the LibreOffice 7-1 series in versions prior to 7.1.2, and in the 7-0 series in versions prior to 7.0.5, the denylist can be circumvented by manipulating the link so it doesn't match the denylist but results in ShellExecute attempting to launch an executable type.
Affected configurations
• libreoffice libreoffice (>= 7.0.0 < 7.0.5)
• libreoffice libreoffice (>= 7.1.0 < 7.1.2)
Related
Weakness · CWE (1)
- CWE-184 Incomplete List of Disallowed Inputs weakness
References
- https://positive.security/blog/url-open-rce#open-libreoffice Exploit, Third Party Advisory
- https://www.libreoffice.org/about-us/security/advisories/cve-2021-25631/ Vendor Advisory
- https://positive.security/blog/url-open-rce#open-libreoffice Exploit, Third Party Advisory
- https://www.libreoffice.org/about-us/security/advisories/cve-2021-25631/ Vendor Advisory