CVE-2022-38745

High

Description

Apache OpenOffice versions before 4.1.14 may be configured to add an empty entry to the Java class path. This may lead to run arbitrary Java code from the current directory.

SeverityHigh

CVSS7.8

Exploit probability59. percentile0.9%

Product

Apache Openoffice

PublishedMar 24, 2023

First seenMar 24, 2023

Weakness typeCWE-94Code injection CWE-1188CWE-1188 CWE-427CWE-427

How to fix

Update

apache openoffice4.1.14 or later

Vendor advisories

lists.apache.org/thread/q3noq7m681kvtb29m28x74q8cnwnzzo0

Affected products

Product	Affected versions	Fixed in
apache openoffice	v < 4.1.14	4.1.14

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.