Think you have a false positive on this rule?

Sid 1-47566

Message

FILE-OFFICE LibreOffice WEBSERVICE arbitrary file disclosure attempt

Summary

This event is generated when an attacker attempts to exploit an arbitrary file disclosure vulnerability in LibreOffice.

Impact

Attempted User Privilege Gain

CVE-2018-6871:

CVSS base score 9.8

CVSS impact score 5.9

CVSS exploitability score 3.9

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Detailed information

Rule checks for attempts to exploit an arbitrary file disclosure vulnerability in LibreOffice. CVE-2018-6871: LibreOffice before 5.4.5 and 6.x before 6.0.1 allows remote attackers to read arbitrary files via =WEBSERVICE calls in a document, which use the COM.MICROSOFT.WEBSERVICE function.

Affected systems

libreoffice libreoffice 3.3.202
libreoffice libreoffice 3.5.2
libreoffice libreoffice 4.2.4
libreoffice libreoffice 4.3.4
libreoffice libreoffice 4.3.5
libreoffice libreoffice 4.3.6
libreoffice libreoffice 4.4.0
libreoffice libreoffice 4.4.1
libreoffice libreoffice 5.0.3
libreoffice libreoffice 5.0.4
libreoffice libreoffice 5.0.5
libreoffice libreoffice 5.2.6
libreoffice libreoffice 5.2.6.1
libreoffice libreoffice 5.3.0.0
libreoffice libreoffice 6.0.0

Ease of attack

CVE-2018-6871:

Access Vector

Access Complexity

Authentication

False positives

Not known

False negatives