VULNERABILITY INTELLIGENCE

CVE-2023-47804

CVSS score8.8 HIGH

EPSS probability2.73%

CISA KEVNot currently listed

Published2023-12-29

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Description

Apache OpenOffice documents can contain links that call internal macros with arbitrary arguments. Several URI Schemes are defined for this purpose. Links can be activated by clicks, or by automatic document events. The execution of such links must be subject to user approval. In the affected versions of OpenOffice, approval for certain links is not requested; when activated, such links could therefore result in arbitrary script execution. This is a corner case of CVE-2022-47502.

Weakness classification

security@apache.org: CWE-20
nvd@nist.gov: CWE-88

Primary references

security@apache.org — Mailing List, Third Party Advisory
security@apache.org — Mailing List, Vendor Advisory
security@apache.org — Patch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 — Mailing List, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Mailing List, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 — Patch, Vendor Advisory