CVE-2022-37401 Apache OpenOffice Weak Master Keys
Weak master key entropy allows attackers with local access to brute force and decrypt stored web connection passwords.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-37401?
CVE-2022-37401 is a high-severity vulnerability in Apache Openoffice, published on 13 Aug 2022. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Apache OpenOffice supports the storage of passwords for web connections in the user's configuration database. The stored passwords are encrypted with a single master key provided by the user. A flaw in OpenOffice existed where master key was poorly encoded resulting in weakening its entropy from 128 to 43 bits making the stored passwords vulnerable to a brute force attack if an attacker has access to the users stored config. This issue affects: Apache OpenOffice versions prior to 4.1.13. Reference: CVE-2022-26307 - LibreOffice
Weakness: CWE-331
Which versions are affected by CVE-2022-37401?
It affects 1 product.
Products include Apache Openoffice.
How do I fix CVE-2022-37401?
No fix has been published for CVE-2022-37401 yet. Limit exposure of the affected software until one is available.
Is CVE-2022-37401 being exploited?
There is no known exploitation of CVE-2022-37401 in the wild and no public exploit code.
Other vulnerabilities in Apache Openoffice
Sources
Also known as GHSA-468w-rc5f-76wx.