PT-2023-22108 · Google · Google Docs

Published 2023-11-02 · Updated 2024-01-12 · CVE-2023-29044

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Google Docs versions prior to the fixed version

Description The issue allows documents operations to be manipulated to contain invalid data types, possibly script code. This could lead to script code injection into an operation that would be executed for users actively collaborating on the same document. The operation data exchanged between collaborating parties is not properly escaped, which could allow code execution. No publicly available exploits are known.

Recommendations For Google Docs versions prior to the fixed version, consider disabling collaborative document editing until a patch is available. As a temporary workaround, restrict access to collaborative document features to minimize the risk of exploitation. Avoid using collaborative document editing features in Google Docs until the issue is resolved.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-29044

Affected Products

Google Docs

References · 7

• https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6243_7.10.6_2023-08-01.pdf · Vendor Advisory
• https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0004.json · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-29044 · Security Note
• https://osv.dev/vulnerability/CVE-2023-29044 · Vendor Advisory
• https://twitter.com/CVEnew/status/1720068049968189778 · Twitter Post
• https://t.me/cibsecurity/73441 · Telegram Post
• https://t.me/cvenotify/67168 · Telegram Post