PT-2021-17762 · Apache · Apache Openoffice+1

Arrigo Marchiori · Published 2021-09-23 · Updated 2022-07-29 · CVE-2021-28129

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Apache OpenOffice version 4.1.8

Description: A developer discovered that the DEB package of Apache OpenOffice did not install using root, but instead used a userid and groupid of 500. This caused issues with desktop integration and could allow a crafted attack on files owned by that user or group if they exist.

Recommendations: For Apache OpenOffice version 4.1.8, upgrade to the latest version of Apache OpenOffice.

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2021-28129

Affected Products

Apache Openoffice

Openoffice

References · 6

• https://osv.dev/vulnerability/CVE-2021-28129 · Vendor Advisory
• https://lists.apache.org/thread.html/rc9090ab48b4699494b63b35cd6d7414c52d665ecae12add3cdc56c9b%40%3Cusers.openoffice.apache.org%3E · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-28129 · Security Note
• https://lists.apache.org/thread.html/r9e72234dd662280fa1a3cca6164d3470a1dbc0d8e53e48ba27f787ce%40%3Cannounce.apache.org%3E · Note
• https://t.me/cvenotify/22072 · Telegram Post
• http://openwall.com/lists/oss-security/2021/10/07/5 · Note