LibreOffice macro permission bypass via hyperlinks (CVE-2023-6186)
CVE-2023-6186 Published on December 11, 2023

Link targets allow arbitrary script execution
Insufficient macro permission validation of The Document Foundation LibreOffice allows an attacker to execute built-in macros without warning. In affected versions LibreOffice supports hyperlinks with macro or similar built-in command targets that can be executed when activated without warning the user.

Vendor Advisory NVD

Vulnerability Analysis

Attack Vector:
ADJACENT_NETWORK
Attack Complexity:
LOW
Privileges Required:
LOW
User Interaction:
REQUIRED
Scope:
CHANGED
Confidentiality Impact:
LOW
Integrity Impact:
HIGH
Availability Impact:
HIGH

Products Associated with CVE-2023-6186

You can be notified by email with stack.watch whenever vulnerabilities like CVE-2023-6186 are published in these products:

Canonical Ubuntu Linux
 
LibreOffice
 
Fedora Project Fedora
 
Debian Linux
 

Affected Versions

The Document Foundation LibreOffice:

Exploit Probability

EPSS
0.77%
Percentile
53.77%

EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.