PT-2023-7598 · Document Foundation+2 · Libreoffice+2

Ry0Tak

·

Published

2023-12-04

·

Updated

2023-12-13

·

CVE-2023-49782

CVSS v2.0

7.5

High

VectorAV:N/AC:L/Au:N/C:P/I:P/A:P
Name of the Vulnerable Software and Affected Versions Collabora Online - Built-in CODE Server versions prior to 23.5.601
Description The issue is related to the proxy.php script in the Collabora Online - Built-in CODE Server, which fails to protect the web page structure when handling error messages. This can allow a remote attacker to conduct cross-site scripting attacks. Collabora Online is a collaborative online office suite based on LibreOffice technology. Users of Nextcloud with the Collabora Online - Built-in CODE Server app can be vulnerable to attack via proxy.php.
Recommendations For versions prior to 23.5.601, upgrade to release 23.5.601 or later to fix the issue. As a temporary workaround, consider restricting access to the proxy.php script until the upgrade is applied. There are no known workarounds for this vulnerability, so upgrading to the fixed release is the recommended course of action.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2023-08658
CVE-2023-49782
GHSA-8XM5-PGFR-8MJR

Affected Products

Collabora Online - Built-In Code Server
Libreoffice
Nextcloud