CVE-2022-37400: Apache OpenOffice Static Initialization Vector Allows to Recover Passwords for Web Connections Without Knowing the Master Password
Apache OpenOffice supports the storage of passwords for web connections in the user's configuration database. The stored passwords are encrypted with a single master key provided by the user. A flaw in OpenOffice existed where the required initialization vector for encryption was always the same which weakens the security of the encryption making them vulnerable if an attacker has access to the user's configuration data. This issue affects: Apache OpenOffice versions prior to 4.1.13. Reference: CVE-2022-26306 - LibreOffice
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2022-37400?
CVE-2022-37400 is a vulnerability in Apache OpenOffice that allows the storage of passwords for web connections in the user's configuration database.
How does Apache OpenOffice store passwords for web connections?
Apache OpenOffice stores passwords for web connections in the user's configuration database.
Are the stored passwords encrypted in Apache OpenOffice?
Yes, the stored passwords in Apache OpenOffice are encrypted with a single master key provided by the user.
What is the severity of CVE-2022-37400?
The severity of CVE-2022-37400 is high, with a CVSS score of 8.8.
How can the vulnerability CVE-2022-37400 be fixed?
To fix CVE-2022-37400, users should update to Apache OpenOffice version 4.1.14 or later, which contains the necessary patch to address the vulnerability.