PT-2023-3415 · Unknown · Libreoffice

Icare · Published 2023-06-20 · Updated 2024-01-12 · CVE-2023-26435

Positive Technologies (AI Summary)

CVSS v3.1

5.0

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions LibreOffice (affected versions not specified)

Description The issue is related to insufficient validation of requests on the server side, allowing attackers to access the file system using specially crafted ODT documents. This could enable the discovery of restricted network topology and services, as well as the inclusion of local files with read permissions of the open-xchange system user. The vulnerability is limited to specific file types, such as images. Improved content filters and validators have been implemented to prevent the inclusion of local resources. No publicly available exploits are known.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

BDU:2023-03592

CVE-2023-26435

Affected Products

Libreoffice

References · 10

• https://bdu.fstec.ru/vul/2023-03592 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-26435 · Security Note
• https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0002.json · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-26435 · Vendor Advisory
• https://t.me/cvenotify/52851 · Telegram Post
• http://seclists.org/fulldisclosure/2023/Jun/8 · Note
• https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6219_7.10.6_2023-03-20.pdf · Note
• https://documentation.open-xchange.com/security/advisories/csaf/oxas-adv-2023-0002.json · Note
• https://vuldb.com/?id.232002 · Note
• http://packetstormsecurity.com/files/173083/OX-App-Suite-SSRF-Resource-Consumption-Command-Injection.html · Note