CVE-2023-2255

Remote documents loaded without prompt via IFrame

State: Published
Severity: Not scored
Published: May 25, 2023
Updated: Aug 2, 2024
Reserved: Apr 24, 2023

Description

Improper access control in editor components of The Document Foundation LibreOffice allowed an attacker to craft a document that would cause external links to be loaded without prompt. In the affected versions of LibreOffice documents that used "floating frames" linked to external files, would load the contents of those frames without prompting the user for permission to do so. This was inconsistent with the treatment of other linked content in LibreOffice. This issue affects: The Document Foundation LibreOffice 7.4 versions prior to 7.4.7; 7.5 versions prior to 7.5.3.

Scores

The record has no CVSS score.

Weaknesses

CWE-264 Permissions, Privileges, and Access Controls

Affected Products

Product	Versions
LibreOfficeThe Document Foundation	7.4 to before 7.4.7Affected 7.5 to before 7.5.3Affected

References

https://www.libreoffice.org/about-us/security/advisories/CVE-2023-2255
DSA-5415vendor-advisory
[debian-lts-announce] 20230813 [SECURITY] [DLA 3526-1] libreoffice security updatemailing-list
GLSA-202311-15vendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.