CVE-2023-47804

CWE-20 — Improper Input Validation CWE-883 documents3 sources

Severity

8.8HIGH

EPSS

2.3%

top 15.20%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Apache Openoffice Apache Software Foundation Apache Openoffice

Timeline

PublishedDec 29

Description

Apache OpenOffice documents can contain links that call internal macros with arbitrary arguments. Several URI Schemes are defined for this purpose. Links can be activated by clicks, or by automatic document events. The execution of such links must be subject to user approval. In the affected versions of OpenOffice, approval for certain links is not requested; when activated, such links could therefore result in arbitrary script execution. This is a corner case of CVE-2022-47502.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages2 packages

▶NVDapache/openoffice< 4.1.15

▶CVEListV5apache_software_foundation/apache_openoffice4.1.14

Patches

Patch: www.openoffice.org ↗Patch: www.openoffice.org ↗

🔴Vulnerability Details

GHSA

GHSA-cmm4-pc7p-g834: Apache OpenOffice documents can contain links that call internal macros with arbitrary arguments↗2023-12-29

▶

CVEList

Apache OpenOffice: Macro URL arbitrary script execution↗2023-12-29

▶