CVE-2022-26306

Name of the Vulnerable Software and Affected Versions LibreOffice versions prior to 7.2.7 LibreOffice versions prior to 7.3.1

Description The issue is related to insufficiently strong encryption of data in the user configuration database of LibreOffice. This weakness can be exploited by a remote attacker to disclose protected information. The stored passwords for web connections are encrypted with a single master key provided by the user, but the required initialization vector for encryption is always the same, weakening the security of the encryption.

Recommendations For versions prior to 7.2.7, update to version 7.2.7 or later. For versions prior to 7.3.1, update to version 7.3.1 or later. As a temporary workaround, consider restricting access to the user's configuration data to minimize the risk of exploitation.