CVE-2022-37400 Weak cryptography in Apache OpenOffice
An attacker with access to configuration files can recover stored web connection passwords due to a static initialization vector in encryption.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-37400?
CVE-2022-37400 is a high-severity vulnerability in Apache Openoffice, published on 13 Aug 2022. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Apache OpenOffice supports the storage of passwords for web connections in the user's configuration database. The stored passwords are encrypted with a single master key provided by the user. A flaw in OpenOffice existed where the required initialization vector for encryption was always the same which weakens the security of the encryption making them vulnerable if an attacker has access to the user's configuration data. This issue affects: Apache OpenOffice versions prior to 4.1.13. Reference: CVE-2022-26306 - LibreOffice
Weakness: CWE-330
Which versions are affected by CVE-2022-37400?
It affects 1 product.
Products include Apache Openoffice.
How do I fix CVE-2022-37400?
No fix has been published for CVE-2022-37400 yet. Limit exposure of the affected software until one is available.
Is CVE-2022-37400 being exploited?
There is no known exploitation of CVE-2022-37400 in the wild and no public exploit code.
Other vulnerabilities in Apache Openoffice
Sources
Also known as GHSA-x2qp-w4jg-wv76.