CVE-2022-3140

Katalog CVE

CVSS 6.3 · Medium EPSS 6,9%

Kerentanan Improper Input Validation pada libreoffice, debian linux +1 lainnya. Skor CVSS 3.1 6.3 (Medium) menurut NVD.

Deskripsi (NVD)

LibreOffice supports Office URI Schemes to enable browser integration of LibreOffice with MS SharePoint server. An additional scheme 'vnd.libreoffice.command' specific to LibreOffice was added. In the affected versions of LibreOffice links using that scheme could be constructed to call internal macros with arbitrary arguments. Which when clicked on, or activated by document events, could result in arbitrary script execution without warning. This issue affects: The Document Foundation LibreOffice 7.4 versions prior to 7.4.1; 7.3 versions prior to 7.3.6.

Rincian

Terbit di NVD

11 Oktober 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

6.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-20: Improper Input Validation
CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')

EPSS (30 hari)

6,9% peluang dieksploitasi; lebih tinggi dari 93,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.libreoffice.org/about-us/security/advisories/CVE-2022-3140 advisory vendor
• https://security.gentoo.org/glsa/202212-04 advisory pihak ketiga
• https://www.debian.org/security/2022/dsa-5252 advisory pihak ketiga
• https://lists.debian.org/debian-lts-announce/2023/03/msg00022.html
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TORANVTIWWBH3...