PT-2023-8594 · Collabora · Collabora Server+2

Highoanalavinia · Published 2023-11-09 · Updated 2023-11-17 · CVE-2023-46743

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:P/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions application-collabora versions prior to 1.3

Description The issue is related to the application-collabora integration of Collabora Online in XWiki, where the rights of a user over a document are not properly enforced. Specifically, when a user opens an attachment file in edit mode, this right is preserved for all future users until the editing session is closed, even if some of them only have view rights. The Collabora server is responsible for issuing this request, and it appears that the userCanWrite query parameter is cached.

Recommendations For versions prior to 1.3, update to version 1.3 to resolve the issue. As a temporary workaround, consider restricting access to the Collabora server or disabling the editing functionality for users with only view rights until the patch is applied.

Exploit

Fix

Incorrect Default Permissions

Weakness Enumeration

CWE-276

Related Identifiers

BDU:2024-01247

CVE-2023-46743

GHSA-MVQ3-XXG2-RJ57

Affected Products

Collabora Online

Collabora Server

Application-Collabora

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/46xxx/CVE-2023-46743.json · Exploit
• 🔥 https://github.com/xwikisas/application-collabora/security/advisories/GHSA-mvq3-xxg2-rj57 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-46743 · Security Note
• https://osv.dev/vulnerability/CVE-2023-46743 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-01247 · Security Note
• https://t.me/cvenotify/60596 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1722671426409271391 · Twitter Post