Vulnerability in Libreoffice
CVE-2023-2255
Improper access control in editor components of The Document Foundation LibreOffice allowed an attacker to craft a document that would cause external links to be loaded without prompt. In the affected versions of LibreOffice documents that used "floating frames" linked to external files, would load the contents of those frames without prompting the user for permission to do so. This was inconsistent with the treatment of other linked content in LibreOffice. This issue affects: The Document Foundation LibreOffice 7.4 versions prior to 7.4.7; 7.5 versions prior to 7.5.3.
EPSS: 0.022 (81.0th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N.
Affected products
- Libreoffice
- The Document Foundation Libreoffice — versions 7.4, 7.5
- Debian Debian_linux — versions 11.0
Weakness classification (CWE)
Public proof-of-concept exploits
References
- security@documentfoundation.org (Vendor Advisory)
- security@documentfoundation.org (vendor-advisory, Third Party Advisory)
- security@documentfoundation.org (mailing-list)
- security@documentfoundation.org (vendor-advisory)
Frequently asked questions
- What is CVE-2023-2255?
- CVE-2023-2255 is a medium-severity vulnerability in Libreoffice, classified under CWE-264. CVSS score: 5.3/10. Published 2023-05-25.
- How severe is CVE-2023-2255?
- Medium severity. CVSS v3 base score is 5.3 out of 10.
- Is CVE-2023-2255 known to be exploited?
- 11 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.