Apache OpenOffice up to 4.1.12 User Configuration Database inadequate encryption

Summaryinfo

A vulnerability marked as problematic has been reported in Apache OpenOffice up to 4.1.12. This impacts an unknown function of the component User Configuration Database. This manipulation causes inadequate encryption. This vulnerability appears as CVE-2022-37401. The attack may be initiated remotely. There is no available exploit. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability was found in Apache OpenOffice up to 4.1.12 (Office Suite Software). It has been declared as problematic. Affected by this vulnerability is an unknown code of the component User Configuration Database. The manipulation with an unknown input leads to a inadequate encryption vulnerability. The CWE definition for the vulnerability is CWE-326. The product stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required. As an impact it is known to affect confidentiality. The summary by CVE is:

Apache OpenOffice supports the storage of passwords for web connections in the user's configuration database. The stored passwords are encrypted with a single master key provided by the user. A flaw in OpenOffice existed where master key was poorly encoded resulting in weakening its entropy from 128 to 43 bits making the stored passwords vulnerable to a brute force attack if an attacker has access to the users stored config. This issue affects: Apache OpenOffice versions prior to 4.1.13. Reference: CVE-2022-26307 - LibreOffice

The weakness was presented 08/15/2022. The advisory is shared at openoffice.org. This vulnerability is known as CVE-2022-37401 since 08/04/2022. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1600 for this issue.

Upgrading to version 4.1.13 eliminates this vulnerability.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Office Suite Software

Vendor

• Apache

Name

• OpenOffice

Version

• 4.1.0
• 4.1.1
• 4.1.2
• 4.1.3
• 4.1.4
• 4.1.5
• 4.1.6
• 4.1.7
• 4.1.8
• 4.1.9
• 4.1.10
• 4.1.11
• 4.1.12

License

• open-source

Website

• Vendor: https://www.apache.org/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion