PT-2020-6159 · Apache · Apache Openoffice+1

Published 2020-11-10 · Updated 2020-12-01 · CVE-2020-13958

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Apache OpenOffice (affected versions not specified)

Description The issue is related to insufficient access control when handling hyperlinks in Apache OpenOffice. An attacker can exploit this to gain unauthorized access to protected information by using specially crafted documents containing hyperlinks. These hyperlinks can point to an executable on the target user's file system and can be triggered unconditionally. In fixed versions, internal protocols cannot be called from the document event handler, and other hyperlinks require a control-click.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

BDU:2021-03214

CVE-2020-13958

Affected Products

Apache Openoffice

Openoffice

References · 7

• https://lists.apache.org/thread.html/r6b2f48cf6c4aad4ebd13f90033162276b0ccae63bea2d3d89cdaf355%40%3Cannounce.openoffice.apache.org%3E · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-13958 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-03214 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2020-13958 · Security Note
• https://t.me/cybersecuritytechnologies/2095 · Telegram Post
• https://openoffice.org/security/cves/CVE-2020-13958.html · Note
• https://t.me/cibsecurity/16449 · Telegram Post