CVE-2022-38745

Apache OpenOffice versions before 4.1.14 may be configured to add an empty entry to the Java class path. This may lead to run arbitrary Java code from the current directory.

Score

CVSS 3.1 7.8 High

Status

Modified - security@apache.org

Published

2023-03-24

Last modified

2025-02-13

Weaknesses

CWE-1188, CWE-427, CWE-94

Affected products

• Openoffice (Apache)
• Apache Openoffice (Apache Software Foundation)

References

• https://lists.apache.org/thread/q3noq7m681kvtb29m28x74q8cnwnzzo0
• https://www.openoffice.org/security/cves/CVE-2022-38745.html