Login Request a demo
High severity · published Dec 29, 2023
CVE-2023-47804
Apache OpenOffice documents can contain links that call internal macros with arbitrary arguments
8.8
CVSS
2.7%
EPSS
No
On KEV
Description
Apache OpenOffice documents can contain links that call internal macros with arbitrary arguments. Several URI Schemes are defined for this purpose. Links can be activated by clicks, or by automatic document events. The execution of such links must be subject to user approval. In the affected versions of OpenOffice, approval for certain links is not requested; when activated, such links could therefore result in arbitrary script execution. This is a corner case of CVE-2022-47502.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.7% · higher than 86% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OP
Openoffice · Apache
before 4.1.15 · source: NVD
Affected product
OP
Openoffice
Apache
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-47804
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-47804
Mailing List
http://www.openwall.com/lists/oss-security/2024/01/03/3
Mailing List
https://lists.apache.org/thread/ygp59swfcy6g46jf8v9s6qpwmxn8fsvb
Patch
https://www.openoffice.org/security/cves/CVE-2023-47804.html
More from Openoffice
8.8
CVE-2022-37401
Apache OpenOffice supports the storage of passwords for web connections in the user's configuration database
8.8
CVE-2022-37400
Apache OpenOffice supports the storage of passwords for web connections in the user's configuration database
8.8
CVE-2021-30245
The project received a report that all versions of Apache OpenOffice through 4.1.8 can open non-http(s) hyperlinks
8.1
CVE-2025-64403
Apache OpenOffice Calc spreadsheet can contain links to other files, in the form of "external data sources"
7.8
CVE-2022-47502
Apache OpenOffice documents can contain links that call internal macros with arbitrary arguments