Vulnerability in Libreoffice
CVE-2023-6186
Insufficient macro permission validation of The Document Foundation LibreOffice allows an attacker to execute built-in macros without warning. In affected versions LibreOffice supports hyperlinks with macro or similar built-in command targets that can be executed when activated without warning the user.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.3 (High). Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:C/C:L/I:H/A:H.
EPSS exploit prediction
EPSS: 0.008 (54.9th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 55th percentile — 54.9% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.008 · newest: 0.008 · change: 0.000
Affected products
- Libreoffice
- The Document Foundation Libreoffice — versions 7.5, 7.6
- Debian Linux — versions 11.0, 12.0
- Fedoraproject Fedora — versions 38
Weakness classification (CWE)
References
- www.libreoffice.org/about-us/security/advisories/cve-2023-6186 (vendor-advisory, Vendor Advisory)
- www.debian.org/security/2023/dsa-5574 (Third Party Advisory)
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/… (Mailing List, Third Party Advisory)
- lists.debian.org/debian-lts-announce/2023/12/msg00026.html
Frequently asked questions
- What is CVE-2023-6186?
- CVE-2023-6186 is a high-severity vulnerability in Libreoffice, classified under Improper Preservation of Permissions. CVSS score: 8.3/10. Published 2023-12-11.
- How severe is CVE-2023-6186?
- High severity. CVSS v3 base score is 8.3 out of 10.