Threat Investigation
Request a demo

CVE-2022-37400

High

Description

Apache OpenOffice supports the storage of passwords for web connections in the user's configuration database. The stored passwords are encrypted with a single master key provided by the user. A flaw in OpenOffice existed where the required initialization vector for encryption was always the same which weakens the security of the encryption making them vulnerable if an attacker has access to the user's configuration data. This issue affects: Apache OpenOffice versions prior to 4.1.13. Reference: CVE-2022-26306 - LibreOffice

SeverityHigh
CVSS8.8
Exploit probability—
ProductApache Openoffice
PublishedAug 15, 2022
First seenAug 15, 2022
Weakness typeCWE-330CWE-330

How to fix

Update
  • apache openoffice4.1.13 or later

Affected products

ProductAffected versionsFixed in
apache openofficev < 4.1.134.1.13

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.