Vulnerability · Published Feb 23, 2021 · Assigned by Document Fdn.
CVE-2021-25630
High 7.8
In plain English
A high-severity security flaw in Collabora Online from Collabora Productivity. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 24% of all known vulnerabilities).
Severity (CVSS NVD)7.8High
Exploit odds (30 days)0.3%top 76.1% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
"loolforkit" is a privileged program that is supposed to be run by a special, non-privileged "lool" user. Before doing anything else "loolforkit" checks, if it was invoked by the "lool" user, and refuses to run with privileges, if it's not the case. In the vulnerable version of "loolforkit" this check was wrong, so a normal user could start "loolforkit" and eventually get local root privileges.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Collabora Productivity | Collabora Online | Collabora Online 4.2 – before 4.2.13Collabora Online 6.4 – before 6.4.3 |
| The Document Foundation | LibreOffice Online | unspecified – through 7.0.1.1 |