PT-2023-7599 · Collabora · Collabora Online

Ubercomp · Publicado 2023-11-30 · Atualizado 2023-12-13 · CVE-2023-49788

Positive Technologies (AI Summary)

CVSS v3.1

7.2

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Collabora Online - Built-in CODE Server (richdocumentscode) versions prior to 23.5.602

Description The issue is related to the Collabora Online - Built-in CODE Server (richdocumentscode) running without chroot sandboxing, making it susceptible to attacks via modified client->server commands. This can allow overwriting files outside the subdirectory provided for the transient session, with access limited to files the server process can access. The bug was fixed in release 23.5.602.

Recommendations For versions prior to 23.5.602, upgrade to release 23.5.602 or later to resolve the issue. There are no known workarounds for this vulnerability.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-501

CWE-22

Identificadores relacionados

BDU:2023-08659

CVE-2023-49788

GHSA-3R69-XVF7-V94J

Produtos afetados

Collabora Online

Referências · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/49xxx/CVE-2023-49788.json · Exploit
• https://github.com/CollaboraOnline/online/security/advisories/GHSA-3r69-xvf7-v94j · Aviso do Fabricante
• https://twitter.com/VulmonFeeds/status/1733238689768112504 · Publicação no Twitter
• https://bdu.fstec.ru/vul/2023-08659 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2023-49788 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-49788 · Aviso do Fabricante
• https://t.me/cvenotify/63523 · Publicação no Telegram
• https://vuldb.com/ru/?id.247313 · Nota
• https://twitter.com/CVEnew/status/1733222060296642694 · Publicação no Twitter