CVE-2023-2255

MEDIUM

Libreoffice < 7.4.7 - Access Control

Title source: rule
STIX 2.1

Description

Improper access control in editor components of The Document Foundation LibreOffice allowed an attacker to craft a document that would cause external links to be loaded without prompt. In the affected versions of LibreOffice documents that used "floating frames" linked to external files, would load the contents of those frames without prompting the user for permission to do so. This was inconsistent with the treatment of other linked content in LibreOffice. This issue affects: The Document Foundation LibreOffice 7.4 versions prior to 7.4.7; 7.5 versions prior to 7.5.3.

Exploits (3)

nomisec WORKING POC 63 stars
by elweth-sec · poc
https://github.com/elweth-sec/CVE-2023-2255
nomisec WORKING POC
by G4sp4rCS · poc
https://github.com/G4sp4rCS/CVE-2023-2255
nomisec WORKING POC
by SaintMichae64 · poc
https://github.com/SaintMichae64/CVE-2023-2255

References (4)

Core 4

Scores

CVSS v3 5.3
EPSS 0.4250
EPSS Percentile 97.5%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Details

CWE
CWE-264
Status published
Products (2)
debian/debian_linux 11.0
libreoffice/libreoffice 7.4.0 - 7.4.7
Published May 25, 2023
Tracked Since Feb 18, 2026