Information Disclosure in Apache OpenOffice by The Document Rendering Process

CVE-2017-3157

Summary

Apache OpenOffice prior to version 4.1.4 contains a vulnerability that allows an attacker to exploit the application’s handling of embedded objects. By creating a specially crafted document, the attacker can trick users into saving the document, leading to potential unauthorized access to sensitive files stored on the user's system. This issue relies on the user being manipulated into providing access by saving the malicious document, which might include hidden sections designed to retrieve information from the filesystem. Although the attacker must possess knowledge of the file path on the target system, the successful execution of this exploit poses a risk of data breaches.

References