High severity · published Mar 24, 2023
CVE-2022-38745
Apache OpenOffice versions before 4.1.14 may be configured to add an empty entry to the Java class path
7.8
CVSS
0.9%
EPSS
No
On KEV
Description
Apache OpenOffice versions before 4.1.14 may be configured to add an empty entry to the Java class path. This may lead to run arbitrary Java code from the current directory.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.9% · higher than 59% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OP
Openoffice · Apache
before 4.1.14 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-38745
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-38745
Mailing List
https://lists.apache.org/thread/q3noq7m681kvtb29m28x74q8cnwnzzo0
Vendor Advisory
https://www.openoffice.org/security/cves/CVE-2022-38745.html
More from Openoffice
8.8
CVE-2023-47804
Apache OpenOffice documents can contain links that call internal macros with arbitrary arguments
8.8
CVE-2022-37401
Apache OpenOffice supports the storage of passwords for web connections in the user's configuration database
8.8
CVE-2022-37400
Apache OpenOffice supports the storage of passwords for web connections in the user's configuration database
8.8
CVE-2021-30245
The project received a report that all versions of Apache OpenOffice through 4.1.8 can open non-http(s) hyperlinks
8.1
CVE-2025-64403
Apache OpenOffice Calc spreadsheet can contain links to other files, in the form of "external data sources"