CVE-2022-38745CWE-1188CWE-427CWE-94
Apache OpenOffice: Empty entry in Java class path
High · published March 24, 2023
What it is
Apache OpenOffice versions before 4.1.14 may be configured to add an empty entry to the Java class path. This may lead to run arbitrary Java code from the current directory.
The record
Technical detail
- CVSS v3.1
- 7.8 · HIGH
- Vector
- CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- CVSS v4.0
- Not supplied
- EPSS
- 0.00872 · 58.5th percentile
- Weaknesses
- CWE-1188 · Initialization of a Resource with an Insecure Default; CWE-427 · Uncontrolled Search Path Element; CWE-94 · Improper Control of Generation of Code ('Code Injection')
- Published
- 2023-03-24T15:56Z
EPSS history
Timeline