CVE-2023-6186

Link targets allow arbitrary script execution

Severity Score

8.8

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

Insufficient macro permission validation of The Document Foundation LibreOffice allows an attacker to execute built-in macros without warning.

In affected versions LibreOffice supports hyperlinks with macro or similar built-in command targets that can be executed when activated without warning the user.

La validación insuficiente de permisos en las macros de The Document Foundation LibreOffice permite a un atacante ejecutar macros integradas sin previo aviso. En las versiones afectadas, LibreOffice admite hipervínculos con macros o destinos de comandos integrados similares que se pueden ejecutar cuando se activan sin advertir al usuario.

An insufficient permission validation vulnerability was found in LibreOffice. In versions that support running commands in hyperlinks, an attacker can execute built-in macros without warning the user.

*Credits: Thanks to Reginaldo Silva of ubercomp.com for finding and reporting this issue

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

High

Availability

High

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2023-11-17 CVE Reserved
2023-12-11 CVE Published
2024-08-02 CVE Updated
2024-11-10 EPSS Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-250: Execution with Unnecessary Privileges
CWE-281: Improper Preservation of Permissions

CAPEC

References (6)

URL	Tag	Source
https://lists.debian.org/debian-lts-announce/2023/12/msg00026.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QB7UB6CTWQUDOE657OVVRSDYUY3IPBJG	Mailing List
https://www.debian.org/security/2023/dsa-5574	Third Party Advisory

URL	Date	SRC

URL	Date	SRC

URL	Date	SRC
https://www.libreoffice.org/about-us/security/advisories/cve-2023-6186	2023-12-31
https://access.redhat.com/security/cve/CVE-2023-6186	2024-06-11
https://bugzilla.redhat.com/show_bug.cgi?id=2254005	2024-06-11

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Libreoffice Search vendor "Libreoffice"		Libreoffice Search vendor "Libreoffice" for product "Libreoffice"				>= 7.5.0 < 7.5.9 Search vendor "Libreoffice" for product "Libreoffice" and version " >= 7.5.0 < 7.5.9"		-		Affected
Libreoffice Search vendor "Libreoffice"		Libreoffice Search vendor "Libreoffice" for product "Libreoffice"				>= 7.6.0 < 7.6.4 Search vendor "Libreoffice" for product "Libreoffice" and version " >= 7.6.0 < 7.6.4"		-		Affected
Fedoraproject Search vendor "Fedoraproject"		Fedora Search vendor "Fedoraproject" for product "Fedora"				38 Search vendor "Fedoraproject" for product "Fedora" and version "38"		-		Affected
Debian Search vendor "Debian"		Debian Linux Search vendor "Debian" for product "Debian Linux"				11.0 Search vendor "Debian" for product "Debian Linux" and version "11.0"		-		Affected
Debian Search vendor "Debian"		Debian Linux Search vendor "Debian" for product "Debian Linux"				12.0 Search vendor "Debian" for product "Debian Linux" and version "12.0"		-		Affected