What is CVE-2023-25266?

CVE-2023-25266 is a high-severity vulnerability in Docmosis Tornado. CVSS score: 8.8/10. Published 2023-02-28.

How severe is CVE-2023-25266?

High severity. CVSS v3 base score is 8.8 out of 10.

Vulnerability in Docmosis Tornado

CVE-2023-25266

An issue was discovered in Docmosis Tornado prior to version 2.9.5. An authenticated attacker can change the Office directory setting pointing to an arbitrary remote network path. This triggers the execution of the soffice binary under the attackers control leading to arbitrary remote code execution (RCE).

EPSS: 0.016 (73.8th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

Affected products

Docmosis Tornado
N/a — versions n/a

References

cve@mitre.org (Release Notes)
cve@mitre.org (Exploit, Third Party Advisory)

Frequently asked questions

What is CVE-2023-25266?: CVE-2023-25266 is a high-severity vulnerability in Docmosis Tornado. CVSS score: 8.8/10. Published 2023-02-28.
How severe is CVE-2023-25266?: High severity. CVSS v3 base score is 8.8 out of 10.