CVE-2023-47804

High

Description

Apache OpenOffice documents can contain links that call internal macros with arbitrary arguments. Several URI Schemes are defined for this purpose. Links can be activated by clicks, or by automatic document events. The execution of such links must be subject to user approval. In the affected versions of OpenOffice, approval for certain links is not requested; when activated, such links could therefore result in arbitrary script execution. This is a corner case of CVE-2022-47502.

SeverityHigh

CVSS8.8

Exploit probability—

Product

Apache Openoffice

PublishedDec 29, 2023

First seenDec 29, 2023

Weakness typeCWE-20Improper input validation CWE-88CWE-88

How to fix

Update

apache openoffice4.1.15 or later

Vendor advisories

lists.apache.org/thread/ygp59swfcy6g46jf8v9s6qpwmxn8fsvb

Affected products

Product	Affected versions	Fixed in
apache openoffice	v < 4.1.15	4.1.15

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.