High severity · published Aug 23, 2024
CVE-2024-37311
Collabora Online's remote host TLS certificates are not fully verified
8.2
CVSS
0.2%
EPSS
No
On KEV
Description
Collabora Online is a collaborative online office suite based on LibreOffice. In affected versions of Collabora Online, https connections from coolwsd to other hosts may incompletely verify the remote host's certificate's against the full chain of trust. This vulnerability is fixed in Collabora Online 24.04.4.3, 23.05.14.1, and 22.05.23.1.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 14% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ON
online · CollaboraOnline
>= 24.04.1.1, < 24.04.4.3; >= 23.05.0-1, < 23.05.14-1; < 22.05.23.1 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-37311
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-37311
github.com
https://github.com/CollaboraOnline/online/security/advisories/GHSA-hvhm-5c44-977x
More from online
9.8
CVE-2025-66208
Configuration-Dependent RCE (OS Command Injection) in richdocumentscode proxy
8.3
CVE-2025-27791
Collabora Online Vulnerable to Arbitrary File Write
6.3
CVE-2025-24796
Remote Code Execution within Collabora Online jail with Macros Enabled
6.1
CVE-2024-45045
JavaScript Injection via url encoded values in links in Collabora Office Android
5.3
CVE-2026-23623
Collabora Online vulnerable to Authorization Bypass