PT-2022-23973 · Apache · Apache Openoffice+1

Selma Jabour · Published 2022-08-13 · Updated 2023-08-02 · CVE-2022-37400

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache OpenOffice versions prior to 4.1.13

Description A flaw in Apache OpenOffice exists where the required initialization vector for encryption is always the same, weakening the security of the encryption. This makes stored passwords vulnerable if an attacker has access to the user's configuration data. The stored passwords are encrypted with a single master key provided by the user.

Recommendations For versions prior to 4.1.13, update to version 4.1.13 or later to resolve the issue. As a temporary workaround, consider restricting access to the user's configuration data to minimize the risk of exploitation.

Fix

Use of Insufficiently Random Values

Weakness Enumeration

CWE-330

Related Identifiers

CVE-2022-37400

Affected Products

Apache Openoffice

Openoffice

References · 6

• https://openoffice.org/security/cves/CVE-2022-37400.html · Patch
• https://osv.dev/vulnerability/CVE-2022-37400 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-37400 · Security Note
• http://openwall.com/lists/oss-security/2022/08/13/1 · Note
• https://t.me/cvenotify/34653 · Telegram Post
• https://t.me/cibsecurity/48130 · Telegram Post