CVE-2023-47804 | BDVDB-2026-220666 Detail

ApacheApache OpenOffice

Description#

Apache OpenOffice documents can contain links that call internal macros with arbitrary arguments. Several URI Schemes are defined for this purpose. Links can be activated by clicks, or by automatic document events. The execution of such links must be subject to user approval. In the affected versions of OpenOffice, approval for certain links is not requested; when activated, such links could therefore result in arbitrary script execution. This is a corner case of CVE-2022-47502.

Impact#

No impact statement in the source data.

Weaknesses#

CWE-20 Improper Input Validation
CWE-88 Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')

References#

https://lists.apache.org/thread/ygp59swfcy6g46jf8v9s6qpwmxn8fsvb
https://www.openoffice.org/security/cves/CVE-2023-47804.html
http://www.openwall.com/lists/oss-security/2024/01/03/3

Exploit#

No public exploit known

History#

Version 12023-12-29Record published in the CVE List.
Version 22025-02-13Most recent update recorded in the CVE List.