LibreOffice Before 7.4.7 Floating Frame External Link Bypass
CVE-2023-2255 Published on May 25, 2023
Remote documents loaded without prompt via IFrame
Improper access control in editor components of The Document Foundation LibreOffice allowed an attacker to craft a document that would cause external links to be loaded without prompt. In the affected versions of LibreOffice documents that used "floating frames" linked to external files, would load the contents of those frames without prompting the user for permission to do so. This was inconsistent with the treatment of other linked content in LibreOffice. This issue affects: The Document Foundation LibreOffice 7.4 versions prior to 7.4.7; 7.5 versions prior to 7.5.3.
Weakness Type
Permissions, Privileges, and Access Controls
Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.
Products Associated with CVE-2023-2255
You can be notified by email with stack.watch whenever vulnerabilities like CVE-2023-2255 are published in these products:
Affected Versions
The Document Foundation LibreOffice:- Version 7.4 and below 7.4.7 is affected.
- Version 7.5 and below 7.5.3 is affected.
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.