CVE-2023-2255

Improper access control in editor components of The Document Foundation LibreOffice allowed an attacker to craft a document that would cause external links to be loaded without prompt. In the affected versions of LibreOffice documents that used "floating frames" linked to external files, would load the contents of those frames without prompting the user for permission to do so. This was inconsistent with the treatment of other linked content in LibreOffice. This issue affects: The Document Foundation LibreOffice 7.4 versions prior to 7.4.7; 7.5 versions prior to 7.5.3.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://lists.debian.org/debian-lts-announce/2023/08/msg00014.html
https://security.gentoo.org/glsa/202311-15
https://www.debian.org/security/2023/dsa-5415	Third Party Advisory
https://www.libreoffice.org/about-us/security/advisories/CVE-2023-2255	Vendor Advisory
https://lists.debian.org/debian-lts-announce/2023/08/msg00014.html
https://security.gentoo.org/glsa/202311-15
https://www.debian.org/security/2023/dsa-5415	Third Party Advisory
https://www.libreoffice.org/about-us/security/advisories/CVE-2023-2255	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:libreoffice:libreoffice::::::::
	cpe:2.3:a:libreoffice:libreoffice::::::::

Configuration 2 (hide)

cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*

History

No history.

Information

Published : 2023-05-25 20:15

Updated : 2024-11-21 07:58

NVD link : CVE-2023-2255

Mitre link : CVE-2023-2255

CVE.ORG link : CVE-2023-2255

JSON object : View

Products Affected

debian

debian_linux

libreoffice

libreoffice

CWE

CWE-264

Permissions, Privileges, and Access Controls

NVD-CWE-Other

{"id": "CVE-2023-2255", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "published": "2023-05-25T20:15:09.350", "references": [{"url": "https://lists.debian.org/debian-lts-announce/2023/08/msg00014.html", "source": "security@documentfoundation.org"}, {"url": "https://security.gentoo.org/glsa/202311-15", "source": "security@documentfoundation.org"}, {"url": "https://www.debian.org/security/2023/dsa-5415", "tags": ["Third Party Advisory"], "source": "security@documentfoundation.org"}, {"url": "https://www.libreoffice.org/about-us/security/advisories/CVE-2023-2255", "tags": ["Vendor Advisory"], "source": "security@documentfoundation.org"}, {"url": "https://lists.debian.org/debian-lts-announce/2023/08/msg00014.html", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://security.gentoo.org/glsa/202311-15", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.debian.org/security/2023/dsa-5415", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.libreoffice.org/about-us/security/advisories/CVE-2023-2255", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "security@documentfoundation.org", "description": [{"lang": "en", "value": "CWE-264"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "descriptions": [{"lang": "en", "value": "Improper access control in editor components of The Document Foundation LibreOffice allowed an attacker to craft a document that would cause external links to be loaded without prompt. In the affected versions of LibreOffice documents that used \"floating frames\" linked to external files, would load the contents of those frames without prompting the user for permission to do so. This was inconsistent with the treatment of other linked content in LibreOffice. This issue affects: The Document Foundation LibreOffice 7.4 versions prior to 7.4.7; 7.5 versions prior to 7.5.3."}], "lastModified": "2024-11-21T07:58:14.943", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:libreoffice:libreoffice:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BE6DDB40-5CAE-4AD0-B7A5-D8E2E8E07C9D", "versionEndExcluding": "7.4.7", "versionStartIncluding": "7.4.0"}, {"criteria": "cpe:2.3:a:libreoffice:libreoffice:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D7FB6F14-A821-42FD-ACDC-3D30292595D4", "versionEndExcluding": "7.5.3", "versionStartIncluding": "7.5.0"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FA6FEEC2-9F11-4643-8827-749718254FED"}], "operator": "OR"}]}], "sourceIdentifier": "security@documentfoundation.org"}