Vulnerability · Published Apr 15, 2021 · Assigned by apache
CVE-2021-30245Code execution in Apache OpenOffice via non-http(s) schemes in Hyperlinks
High 8.8
In plain English
A high-severity security flaw in Apache OpenOffice from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 4.9% (higher than 92% of all known vulnerabilities).
Official description
The project received a report that all versions of Apache OpenOffice through 4.1.8 can open non-http(s) hyperlinks. The problem has existed since about 2006 and the issue is also in 4.1.9. If the link is specifically crafted this could lead to untrusted code execution. It is always best practice to be careful opening documents from unknown and unverified sources. The mitigation in Apache OpenOffice 4.1.10 (unreleased) assures that a security warning is displayed giving the user the option of continuing to open the hyperlink.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Apache Software Foundation | Apache OpenOffice | Apache OpenOffice – through 4.1.9 |
References
- https://lists.apache.org/thread.html/r87ff11512e4883052991e6b725e20294224034ea8453b811fb3ee735%40%3Cusers.openoffice.apache.org%3E x_refsource_MISC
- [openoffice-dev] 20210415 CVE-2021-30245: Code execution in Apache OpenOffice via non-http(s) schemes in Hyperlinks mailing-list, x_refsource_MLIST
- [openoffice-dev] 20210415 Re: CVE-2021-30245: Code execution in Apache OpenOffice via non-http(s) schemes in Hyperlinks mailing-list, x_refsource_MLIST
- [openoffice-users] 20210415 Re: CVE-2021-30245: Code execution in Apache OpenOffice via non-http(s) schemes in Hyperlinks mailing-list, x_refsource_MLIST
- [announce] 20210415 CVE-2021-30245: Code execution in Apache OpenOffice via non-http(s) schemes in Hyperlinks mailing-list, x_refsource_MLIST