CVE-2022-47502

Katalog CVE

CVSS 7.8 · High EPSS 0,96%

Kerentanan Improper Input Validation pada apache openoffice. Skor CVSS 3.1 7.8 (High) menurut NVD.

Deskripsi (NVD)

Apache OpenOffice documents can contain links that call internal macros with arbitrary arguments. Several URI Schemes are defined for this purpose. Links can be activated by clicks, or by automatic document events. The execution of such links must be subject to user approval. In the affected versions of OpenOffice, approval for certain links is not requested; when activated, such links could therefore result in arbitrary script execution.

Rincian

Terbit di NVD

24 Maret 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.8 (High), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-20: Improper Input Validation
CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')

EPSS (30 hari)

0,96% peluang dieksploitasi; lebih tinggi dari 60,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://lists.apache.org/thread/xr6tl91jj2jgcq8pdbrc4d8w13s6xn80 mailing list · advisory vendor
• https://www.openoffice.org/security/cves/CVE-2022-47502.html advisory vendor
• http://www.openwall.com/lists/oss-security/2023/12/28/3
• http://www.openwall.com/lists/oss-security/2024/01/03/3