PT-2023-7599 · Collabora · Collabora Online

Ubercomp · Published 2023-11-30 · Updated 2023-12-13 · CVE-2023-49788

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Collabora Online - Built-in CODE Server (richdocumentscode) versions prior to 23.5.602

Description The issue is related to the Collabora Online - Built-in CODE Server (richdocumentscode) running without chroot sandboxing, making it susceptible to attacks via modified client->server commands. This can allow overwriting files outside the subdirectory provided for the transient session, with access limited to files the server process can access. The bug was fixed in release 23.5.602.

Recommendations For versions prior to 23.5.602, upgrade to release 23.5.602 or later to resolve the issue. There are no known workarounds for this vulnerability.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-501

CWE-22

Related Identifiers

BDU:2023-08659

CVE-2023-49788

GHSA-3R69-XVF7-V94J

Affected Products

Collabora Online

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/49xxx/CVE-2023-49788.json · Exploit
• https://github.com/CollaboraOnline/online/security/advisories/GHSA-3r69-xvf7-v94j · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-08659 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-49788 · Security Note
• https://osv.dev/vulnerability/CVE-2023-49788 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/1733238689768112504 · Twitter Post
• https://t.me/cvenotify/63523 · Telegram Post
• https://vuldb.com/ru/?id.247313 · Note
• https://twitter.com/CVEnew/status/1733222060296642694 · Twitter Post