PT-2023-20009 · Docmosis · Docmosis Tornado

Frycos · Published 2023-02-28 · Updated 2023-03-07 · CVE-2023-25266

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Docmosis Tornado versions prior to 2.9.5

Description An issue allows an authenticated attacker to change the Office directory setting to point to an arbitrary remote network path, triggering the execution of the soffice binary under the attacker's control. This leads to arbitrary remote code execution (RCE).

Recommendations For versions prior to 2.9.5, update to version 2.9.5 or later to resolve the issue. As a temporary workaround, consider restricting access to the Office directory setting to prevent attackers from modifying it.

Exploit

Fix

Related Identifiers

CVE-2023-25266

Affected Products

Docmosis Tornado

References · 5

• 🔥 https://frycos.github.io/vulns4free/2023/01/24/0days-united-nations.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-25266 · Security Note
• https://osv.dev/vulnerability/CVE-2023-25266 · Vendor Advisory
• https://t.me/cibsecurity/59103 · Telegram Post
• https://resources.docmosis.com/content/documentation/tornado-v2-9-5-release-notes · Note