CVEvulnerability
CVE-2022-26306
7.5 HIGH
Official page ↗
- Status
- Modified
- Published
- 2022-07-25
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- Weaknesses
- CWE-326, CWE-330
Description
LibreOffice supports the storage of passwords for web connections in the user’s configuration database. The stored passwords are encrypted with a single master key provided by the user. A flaw in LibreOffice existed where the required initialization vector for encryption was always the same which weakens the security of the encryption making them vulnerable if an attacker has access to the user's configuration data. This issue affects: The Document Foundation LibreOffice 7.2 versions prior to 7.2.7; 7.3 versions prior to 7.3.1.
Affected configurations
• libreoffice libreoffice (>= 7.2.0 < 7.2.7)
• libreoffice libreoffice (>= 7.3.0 < 7.3.3)
• debian debian linux 10.0
Related
References
- http://www.openwall.com/lists/oss-security/2022/08/13/1 Mailing List, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2023/03/msg00022.html Mailing List, Third Party Advisory
- https://www.libreoffice.org/about-us/security/advisories/cve-2022-26306 Vendor Advisory
- http://www.openwall.com/lists/oss-security/2022/08/13/1 Mailing List, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2023/03/msg00022.html Mailing List, Third Party Advisory
- https://www.libreoffice.org/about-us/security/advisories/cve-2022-26306 Vendor Advisory