CVE-2023-2255: Improper access control in editor components of The Document Foundation LibreOffice allowed an attacker to craft a document that would cause external links to…

PriorityP431medium5.3CVSS 3.1

AVNACLPRNUINSUCNILAN

EPSS

2.24%

80.9th percentile

Improper access control in editor components of The Document Foundation LibreOffice allowed an attacker to craft a document that would cause external links to be loaded without prompt. In the affected versions of LibreOffice documents that used "floating frames" linked to external files, would load the contents of those frames without prompting the user for permission to do so. This was inconsistent with the treatment of other linked content in LibreOffice. This issue affects: The Document Foundation LibreOffice 7.4 versions prior to 7.4.7; 7.5 versions prior to 7.5.3.

Affected

12 ranges

Vendor	Product	Version range	Fixed in
apache	openoffice	< 4.1.16	4.1.16
apache_software_foundation	apache_openoffice	<= 4.1.15	—
debian	debian_linux	—	—
debian	libreoffice	< libreoffice 4:7.4.5-3 (bookworm)	libreoffice 4:7.4.5-3 (bookworm)
libreoffice	libreoffice	>= 0 < 1:7.0.4-4+deb11u7	1:7.0.4-4+deb11u7
libreoffice	libreoffice	>= 0 < 4:7.4.5-3	4:7.4.5-3
libreoffice	libreoffice	>= 0 < 4:7.4.5-3	4:7.4.5-3
libreoffice	libreoffice	>= 0 < 4:7.4.5-3	4:7.4.5-3
libreoffice	libreoffice	>= 0 < 1:6.4.7-0ubuntu0.20.04.8	1:6.4.7-0ubuntu0.20.04.8
libreoffice	libreoffice	>= 0 < 1:7.3.7-0ubuntu0.22.04.3	1:7.3.7-0ubuntu0.22.04.3
libreoffice	libreoffice	>= 7.4.0 < 7.4.7	7.4.7
libreoffice	libreoffice	>= 7.5.0 < 7.5.3	7.5.3

CVSS provenance

nvdv3.15.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

osv7.8HIGH

vendor_ubuntu7.8HIGH

vendor_debian5.3MEDIUM

vendor_redhat5.3MEDIUM

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.