CVE-2022-47502
Severity CVSS v4.0:
Pending analysis
Type:
CWE-20
Input Validation
Publication date:
24/03/2023
Last modified:
13/02/2025
Description
Apache OpenOffice documents can contain links that call internal macros with arbitrary arguments. Several URI Schemes are defined for this purpose.<br />
<br />
<br />
Links can be activated by clicks, or by automatic document events.<br />
<br />
The execution of such links must be subject to user approval.<br />
<br />
In the affected versions of OpenOffice, approval for certain links is not requested; when activated, such links could therefore result in arbitrary script execution.
Impact
Base Score 3.x
7.80
Severity 3.x
HIGH
Vulnerable products and versions
| CPE | From | Up to |
|---|---|---|
| cpe:2.3:a:apache:openoffice:*:*:*:*:*:*:*:* | 4.1.13 (including) |
To consult the complete list of CPE names with products and versions, see this page
References to Advisories, Solutions, and Tools
- http://www.openwall.com/lists/oss-security/2023/12/28/3
- http://www.openwall.com/lists/oss-security/2024/01/03/3
- https://lists.apache.org/thread/xr6tl91jj2jgcq8pdbrc4d8w13s6xn80
- https://www.openoffice.org/security/cves/CVE-2022-47502.html
- http://www.openwall.com/lists/oss-security/2023/12/28/3
- http://www.openwall.com/lists/oss-security/2024/01/03/3
- https://lists.apache.org/thread/xr6tl91jj2jgcq8pdbrc4d8w13s6xn80
- https://www.openoffice.org/security/cves/CVE-2022-47502.html