CVE-2021-25630: High severity collabora office online vulnerability
"loolforkit" is a privileged program that is supposed to be run by a special, non-privileged "lool" user. Before doing anything else "loolforkit" checks, if it was invoked by the "lool" user, and refuses to run with privileges, if it's not the case. In the vulnerable version of "loolforkit" this check was wrong, so a normal user could start "loolforkit" and eventually get local root privileges.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2021-25630?
"CVE-2021-25630" refers to a vulnerability in the "loolforkit" program, which allows privilege escalation when run by a non-privileged user.
What is the severity of CVE-2021-25630?
The severity of CVE-2021-25630 is high, with a CVSS score of 7.8.
Which software versions are affected by CVE-2021-25630?
Versions between 4.2.0 and 4.2.13 of Collabora Online and versions between 6.4.0 and 6.4.3 of Collabora Online are affected by CVE-2021-25630.
How does CVE-2021-25630 impact the system?
CVE-2021-25630 allows unauthorized users to run the "loolforkit" program with elevated privileges, leading to potential privilege escalation on the system.
Is there a fix available for CVE-2021-25630?
Yes, it is recommended to update Collabora Online to a version that is not affected by CVE-2021-25630.