CVE-2023-2255

MEDIUM

Remote documents loaded without prompt via IFrame

Title source: CVE List
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2023-2255 has a selected CVSS score of 5.3 (medium); EIP currently links 3 repository PoCs.

Description

Improper access control in editor components of The Document Foundation LibreOffice allowed an attacker to craft a document that would cause external links to be loaded without prompt. In the affected versions of LibreOffice documents that used "floating frames" linked to external files, would load the contents of those frames without prompting the user for permission to do so. This was inconsistent with the treatment of other linked content in LibreOffice. This issue affects: The Document Foundation LibreOffice 7.4 versions prior to 7.4.7; 7.5 versions prior to 7.5.3.

Description source: CVE List

Exploitation context

Available material

Repository PoCs
3

Affected products and versions

1
ProductSourceVersion range

LibreOffice

Browse The Document Foundation / LibreOffice
CVE List7.4 to < 7.4.7affected
7.5 to < 7.5.3affected

Proofs of concept

3

Repository PoCs

GitHubelweth-sec/CVE-2023-2255Repository PoCby elweth-sec65Not analyzed4 files

11.0 KiB

GitHub
PoC details
GitHubSaintMichae64/CVE-2023-2255Repository PoCby SaintMichae640Not analyzed2 files

2.5 KiB

GitHub
PoC details
GitHubG4sp4rCS/CVE-2023-2255Repository PoCby G4sp4rCS0Not analyzed3 files

2.6 KiB

GitHub
PoC details

References

5