CVE-2023-49788CWE-22CWE-501

Improper handling of browser-side provided input in richdocuments path handling

High · published December 8, 2023

CVSS v3.1
7.2
EPSS
0%
Percentile
41.6
In the wild
Unconfirmed
What it is

Collabora Online is a collaborative online office suite based on LibreOffice technology. Unlike a standalone dedicated Collabora Online server, the Built-in CODE Server (richdocumentscode) is run without chroot sandboxing. Vulnerable versions of the richdocumentscode app can be susceptible to attack via modified client->server commands to overwrite files outside the sub directory the server has provided for the transient session. Files which can be accessed are limited to those that the server process has access to. The bug was fixed in Collabora Online - Built-in CODE Server (richdocumentscode) release 23.5.602. Users are advised to upgrade. There are no known workarounds for this vulnerability.

The record
Technical detail
CVSS v3.1
7.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00496 · 41.6th percentile
Weaknesses
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'); CWE-501 · Trust Boundary Violation
Published
2023-12-08T20:02Z
EPSS history
Timeline
  • 08 DEC 20:02Z
    Improper handling of browser-side provided input in richdocuments path handling
    cvelistv5