CVE Vulnerability

CVE-2022-37400

Apache OpenOffice supports the storage of passwords for web connections in the user's configuration database. The stored passwords are encrypted with a single master key provided by the user. A flaw in OpenOffice existed where the required initialization vector for encryption was always the same which weakens the security of the encryption making them vulnerable if an attacker has access to the user's configuration data. This issue affects: Apache OpenOffice versions prior to 4.1.13. Reference: CVE-2022-26306 - LibreOffice

8.8 /10

CVSS v3.0 : HIGH

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
http://www.openwall.com/lists/oss-security/2022/08/13/1 Mailing List Third Party Advisory
https://www.openoffice.org/security/cves/CVE-2022-37400.html Patch Product
Configurations

Configuration 1

cpe:2.3:a:apache:openoffice:*:*:*:*:*:*:*:*
Information

Published : 2022-08-15 11:21

Updated : 2022-08-16 05:06

NVD link : CVE-2022-37400

Mitre link : CVE-2022-37400

Products Affected
No products.
CWE
CWE-326

Inadequate Encryption Strength