VULNERABILITY INTELLIGENCE

CVE-2022-37400

CVSS score8.8 HIGH

EPSS probability0.98%

CISA KEVNot currently listed

Published2022-08-15

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Description

Apache OpenOffice supports the storage of passwords for web connections in the user's configuration database. The stored passwords are encrypted with a single master key provided by the user. A flaw in OpenOffice existed where the required initialization vector for encryption was always the same which weakens the security of the encryption making them vulnerable if an attacker has access to the user's configuration data. This issue affects: Apache OpenOffice versions prior to 4.1.13. Reference: CVE-2022-26306 - LibreOffice

Weakness classification

security@apache.org: CWE-330
nvd@nist.gov: CWE-330

Primary references

security@apache.org — Mailing List, Third Party Advisory
security@apache.org — Patch, Product
af854a3a-2127-422b-91ae-364da2661108 — Mailing List, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Patch, Product