A vulnerability was found in LibreOffice up to 7.2.6/7.3.2 (Office Suite Software). It has been declared as problematic. This vulnerability affects an unknown functionality of the component Configuration Database Handler. The manipulation with an unknown input leads to a inadequate encryption vulnerability. The CWE definition for the vulnerability is CWE-326. The product stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required. As an impact it is known to affect confidentiality. CVE summarizes:

LibreOffice supports the storage of passwords for web connections in the user’s configuration database. The stored passwords are encrypted with a single master key provided by the user. A flaw in LibreOffice existed where master key was poorly encoded resulting in weakening its entropy from 128 to 43 bits making the stored passwords vulerable to a brute force attack if an attacker has access to the users stored config. This issue affects: The Document Foundation LibreOffice 7.2 versions prior to 7.2.7; 7.3 versions prior to 7.3.3.

The weakness was presented 07/26/2022. The advisory is shared for download at libreoffice.org. This vulnerability was named CVE-2022-26307 since 02/28/2022. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1600.

Upgrading to version 7.2.7 or 7.3.3 eliminates this vulnerability.

Productinfo

Type

• Office Suite Software

Name

• LibreOffice

Version

• 7.2.0
• 7.2.1
• 7.2.2
• 7.2.3
• 7.2.4
• 7.2.5
• 7.2.6
• 7.3.0
• 7.3.1
• 7.3.2

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion