CVE-2022-3140CWE-20

CVE-2022-3140: fallo en The Document Foundation LibreOffice

Macro URL arbitrary script execution

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear LibreOffice+ Monitorear libreoffice

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

3Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackepss 7.0%
LibreOffice supports Office URI Schemes to enable browser integration of LibreOffice with MS SharePoint server. An additional scheme 'vnd.libreoffice.command' specific to LibreOffice was added. In the affected versions of LibreOffice links using that scheme could be constructed to call internal macros with arbitrary arguments. Which when clicked on, or activated by document events, could result in arbitrary script execution without warning. This issue affects: The Document Foundation LibreOffice 7.4 versions prior to 7.4.1; 7.3 versions prior to 7.3.6.
Productos afectados
The Document Foundation · LibreOffice
CVEs relacionadas — The Document Foundation LibreOffice

En el mismo producto, de las más peligrosas a las menos.

CVE-2021-25631—denylist of executable filename extensions possible to bypass under windowsEPSS 5.0%CVE-2023-2255—Remote documents loaded without prompt via IFrameEPSS 2.2%CVE-2020-12802—remote graphics contained in docx format retrieved in 'stealth mode'EPSS 2.0%CVE-2020-12803—XForms submissions could overwrite local filesEPSS 1.8%CVE-2022-26307—Weak Master KeysEPSS 1.5%CVE-2020-12801—Crash-recovered MSOffice encrypted documents defaulted to not to using encryption on next saveEPSS 1.3%