Vulnerability in Apache Openoffice
CVE-2021-30245
The project received a report that all versions of Apache OpenOffice through 4.1.8 can open non-http(s) hyperlinks. The problem has existed since about 2006 and the issue is also in 4.1.9. If the link is specifically crafted this could lead to untrusted code execution. It is always best practice to be careful opening documents from unknown and unverified sources. The mitigation in Apache OpenOffice 4.1.10 (unreleased) assures that a security warning is displayed giving the user the option of continuing to open the hyperlink.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.049 (92.1th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 92nd percentile — 92.1% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.049 · newest: 0.049 · change: 0.000
Affected products
- Apache Openoffice
- Apache Software Foundation Openoffice — versions Apache OpenOffice
Weakness classification (CWE)
References
- lists.apache.org/thread.html/r87ff11512e4883052991e6b725e20294224034ea8453b811f… (Patch, Mailing List, Vendor Advisory)
- lists.apache.org/thread.html/r87ff11512e4883052991e6b725e20294224034ea8453b811f… (mailing-list)
- lists.apache.org/thread.html/ra2cabdc083d5160a84de9a6436296ee5030fb3a16dc490dee… (mailing-list)
- lists.apache.org/thread.html/ra2cabdc083d5160a84de9a6436296ee5030fb3a16dc490dee… (mailing-list)
- lists.apache.org/thread.html/r7c01173f763b0c4212ada0e6ab283984d6e058d72258efce8… (mailing-list)
Frequently asked questions
- What is CVE-2021-30245?
- CVE-2021-30245 is a high-severity vulnerability in Apache Openoffice, classified under Externally Controlled Reference to a Resource in Another Sphere. CVSS score: 8.8/10. Published 2021-04-15.
- How severe is CVE-2021-30245?
- High severity. CVSS v3 base score is 8.8 out of 10.