CVE-2019-9853 - CVE House
Back to Database
Status published High CVE-2019-9853

Insufficient URL decoding flaw in categorizing macro location

Vulnerability Description

LibreOffice documents can contain macros. The execution of those macros is controlled by the document security settings, typically execution of macros are blocked by default. A URL decoding flaw existed in how the urls to the macros within the document were processed and categorized, resulting in the possibility to construct a document where macro execution bypassed the security settings. The documents were correctly detected as containing macros, and prompted the user to their existence within the documents, but macros within the document were subsequently not controlled by the security settings allowing arbitrary macro execution This issue affects: LibreOffice 6.2 series versions prior to 6.2.7; LibreOffice 6.3 series versions prior to 6.3.1.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2019-9853

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • Thanks to Nils Emmerich of ERNW Research GmbH for discovering and reporting this issue

References

More from Document Foundation

View All →
CVE-2019-9855
Windows 8.3 path equivalence handling flaw allows LibreLogo script execution
Critical 9.8
CVE-2019-9854
Unsafe URL assembly flaw in allowed script location check
High 7.8
CVE-2019-9852
Insufficient URL encoding flaw in allowed script location check
High 7.8
CVE-2019-9851
LibreLogo global-event script execution
Critical 9.8
CVE-2019-9850
Insufficient url validation allowing LibreLogo script execution
Critical 9.8

Affected Vendor

Document Foundation

View all reports →

Affected Software

LibreOffice
Vulnerable Versions:
6.2 series, 6.3 series

Timeline

Official Publish: September 27th, 2019
Last Modified: September 16th, 2024
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-116

MITRE ATT&CK TTPs

T1189 Drive-by Compromise
Initial Access
T1190 Exploit Public-Facing Application
Initial Access
T1059 Command and Scripting Interpreter
Execution
T1565.002 Stored Data Manipulation
Impact