CVE-2020-13958

7.8HIGH

Key Information:

Vendor
Apache
Status
Apache Openoffice
Vendor
CVE Published:
17 November 2020

Summary

A vulnerability in Apache OpenOffice scripting events allows an attacker to construct documents containing hyperlinks pointing to an executable on the target users file system. These hyperlinks can be triggered unconditionally. In fixed versions no internal protocol may be called from the document event handler and other hyperlinks require a control-click.

Affected Version(s)

Apache OpenOffice Apache OpenOffice 4.0 to 4.1.7

References

https://lists.apache.org/thread.html/r6b2f48cf6c4aad4ebd1...
x_refsource_MISC

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.