VulnerabilityModified
CVE-2022-38745
This may lead to run arbitrary Java code from the current directory.
HIGH 7.8EPSS 0.87%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.87%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Apache OpenOffice versions before 4.1.14 may be configured to add an empty entry to the Java class path. This may lead to run arbitrary Java code from the current directory.
- CVSS 3.1
- 7.8 HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- EPSS
- 0.87% probability · 57th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-94, CWE-427, CWE-1188
- Affected
- apache/openoffice
- Source
- security@apache.org
References
- https://lists.apache.org/thread/q3noq7m681kvtb29m28x74q8cnwnzzo0Mailing List, Vendor Advisory
- https://www.openoffice.org/security/cves/CVE-2022-38745.htmlVendor Advisory
- https://lists.apache.org/thread/q3noq7m681kvtb29m28x74q8cnwnzzo0Mailing List, Vendor Advisory
- https://www.openoffice.org/security/cves/CVE-2022-38745.htmlVendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.