content/security/cves/CVE-2022-47502.html (87 lines of code) (raw):
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
<title>CVE-2022-47502</title>
</head>
<body>
<p>
<a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=2022-47502">CVE-2022-47502</a>
</p>
<p>
<a href="https://www.openoffice.org/security/cves/CVE-2022-47502.html">Apache OpenOffice Advisory</a>
</p>
<p style="text-align:center; font-size:largest">
<strong>Macro URL arbitrary script execution without warning</strong>
</p>
<p style="text-align:center; font-size:larger">
<strong>Fixed in Apache OpenOffice 4.1.14</strong>
</p>
<p>
<strong>Description</strong>
</p>
<p>
Apache OpenOffice documents can contain links that call internal macros with arbitrary arguments.
Several URI Schemes are defined for this purpose.Links can be activated by clicks, or by automatic
document events. The execution of such links must be subject to user approval. In the affected
versions of OpenOffice, approval for certain links is not requested; when activated, such links could
therefore result in arbitrary script execution.
</p>
<p>
<strong>Severity: Critical</strong>
</p>
<p>
There are no known exploits of this vulnerability.
<br />
A proof-of-concept demonstration exists.
</p>
<p>
Thanks to the reporter for discovering this issue.
</p>
<p>
<strong>Vendor: The Apache Software Foundation</strong>
</p>
<p>
<strong>Versions Affected</strong>
</p>
<p>
All Apache OpenOffice versions 4.1.13 and older are affected.
<br />
OpenOffice.org versions may also be affected.
</p>
<p>
<strong>Mitigation</strong>
</p>
<p>
Install Apache OpenOffice 4.1.14 for the latest maintenance and cumulative security fixes.
Use the Apache OpenOffice <a href="https://www.openoffice.org/download/"> download page</a>.
</p>
<p>
<strong>Acknowledgments</strong>
</p>
<p>
The Apache OpenOffice Security Team would like to thank Altin Thartori (tin-z) and
Joachim Mammele for discovering and reporting this attack vector.
</p>
<p>
<strong>Further Information</strong>
</p>
<p>
For additional information and assistance, consult the
<a href="https://forum.openoffice.org/">Apache OpenOffice Community Forums</a>
or make requests to the
<a href="mailto:users@openoffice.apache.org">users@openoffice.apache.org</a>
public mailing list.
</p>
<p>
The latest information on Apache OpenOffice security bulletins can be found at the
<a href="https://www.openoffice.org/security/bulletin.html">Bulletin Archive page</a>.
</p>
<hr />
<p>
<a href="https://security.openoffice.org">Security Home</a>->
<a href="https://www.openoffice.org/security/bulletin.html">Bulletin</a>->
<a href="https://www.openoffice.org/security/cves/CVE-2022-47502.html">CVE-2022-47502</a>
</p>
</body>
</html>