CVE-2022-38745

Summary

Apache OpenOffice versions before 4.1.14 may be configured to add an empty entry to the Java class path. This may lead to run arbitrary Java code from the current directory.

Affected Software

Weaknesses

• CWE-94: CWE-94 Improper Control of Generation of Code ('Code Injection')
• CWE-1188: CWE-1188 Insecure Default Initialization of Resource
• CWE-427: CWE-427 Uncontrolled Search Path Element

ADP Enrichment

CVE Program Container

Additional References

• https://lists.apache.org/thread/q3noq7m681kvtb29m28x74q8cnwnzzo0
• https://www.openoffice.org/security/cves/CVE-2022-38745.html

CISA ADP Vulnrichment

• SSVC:
• Exploitation: none
  • Automatable: no
  • Technical Impact: total

References

• https://lists.apache.org/thread/q3noq7m681kvtb29m28x74q8cnwnzzo0
• https://www.openoffice.org/security/cves/CVE-2022-38745.html

• ←Previous
• Next→