CVE-2022-37400 Apache OpenOffice Static Initialization Vector Allows to Recover Passwords for Web Connections Without Knowing the Master Password

2022-08-1306:40:11

CWE-330

apache

www.cve.org

apache openoffice

password recovery

encryption weakness

web connections

cve-2022-37400

master password

initialization vector

configuration database

vulnerability

apache openoffice version 4.1.13

8.1 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

53.4%

JSON

Apache OpenOffice supports the storage of passwords for web connections in the user’s configuration database. The stored passwords are encrypted with a single master key provided by the user. A flaw in OpenOffice existed where the required initialization vector for encryption was always the same which weakens the security of the encryption making them vulnerable if an attacker has access to the user’s configuration data. This issue affects: Apache OpenOffice versions prior to 4.1.13. Reference: CVE-2022-26306 - LibreOffice

CNA Affected

[
  {
    "product": "Apache OpenOffice",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "lessThan": "4.1.13",
        "status": "affected",
        "version": "Apache OpenOffice 4",
        "versionType": "custom"
      }
    ]
  }
]