PT-2023-3415 · Unknown · Libreoffice

Icare · Publicado 2023-06-20 · Atualizado 2024-01-12 · CVE-2023-26435

Positive Technologies (AI Summary)

CVSS v3.1

5.0

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions LibreOffice (affected versions not specified)

Description The issue is related to insufficient validation of requests on the server side, allowing attackers to access the file system using specially crafted ODT documents. This could enable the discovery of restricted network topology and services, as well as the inclusion of local files with read permissions of the open-xchange system user. The vulnerability is limited to specific file types, such as images. Improved content filters and validators have been implemented to prevent the inclusion of local resources. No publicly available exploits are known.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

SSRF

Enumeração de Fraquezas

CWE-918

Identificadores relacionados

BDU:2023-03592

CVE-2023-26435

Produtos afetados

Libreoffice

Referências · 10

• https://bdu.fstec.ru/vul/2023-03592 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2023-26435 · Nota de Segurança
• https://t.me/cvenotify/52851 · Publicação no Telegram
• https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0002.json · Aviso do Fabricante
• http://seclists.org/fulldisclosure/2023/Jun/8 · Nota
• https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6219_7.10.6_2023-03-20.pdf · Nota
• https://documentation.open-xchange.com/security/advisories/csaf/oxas-adv-2023-0002.json · Nota
• https://vuldb.com/?id.232002 · Nota
• https://osv.dev/vulnerability/CVE-2023-26435 · Aviso do Fabricante
• http://packetstormsecurity.com/files/173083/OX-App-Suite-SSRF-Resource-Consumption-Command-Injection.html · Nota