CVE-2021-30245

CVE-2021-30245: vulnerability in Apache OpenOffice

Code execution in Apache OpenOffice via non-http(s) schemes in Hyperlinks

Published · Updated

Follow this CVE+ Monitor Apache OpenOffice

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

3Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackepss 4.9%
The project received a report that all versions of Apache OpenOffice through 4.1.8 can open non-http(s) hyperlinks. The problem has existed since about 2006 and the issue is also in 4.1.9. If the link is specifically crafted this could lead to untrusted code execution. It is always best practice to be careful opening documents from unknown and unverified sources. The mitigation in Apache OpenOffice 4.1.10 (unreleased) assures that a security warning is displayed giving the user the option of continuing to open the hyperlink.
Affected products
Apache Software Foundation · Apache OpenOffice
Related CVEs — Apache OpenOffice

In the same product, most dangerous first.

CVE-2021-33035—Buffer overflow from a crafted DBF fileEPSS 50.6%CVE-2021-40439—Billion LaughsEPSS 3.9%CVE-2017-3157—CVE-2017-3157EPSS 3.1%CVE-2016-6804—CVE-2016-6804EPSS 3.0%CVE-2017-12608—CVE-2017-12608EPSS 2.9%CVE-2023-47804—Apache OpenOffice: Macro URL arbitrary script executionEPSS 2.7%