CVE-2022-37400 json
Apache OpenOffice Static Initialization Vector Allows to Recover Passwords for Web Connections Without Knowing the Master Password
published 2022-08-13 4 y ago modified 2026-06-17 4 mo ago also EUVD-2022-40033
- cvss
- 8.8
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.0%
- EPSS 1.0% chance of exploitation in 30 days, percentile 62%
- public exploits
- 0
- none known
Summary
Apache OpenOffice supports the storage of passwords for web connections in the user's configuration database. The stored passwords are encrypted with a single master key provided by the user. A flaw in OpenOffice existed where the required initialization vector for encryption was always the same which weakens the security of the encryption making them vulnerable if an attacker has access to the user's configuration data. This issue affects: Apache OpenOffice versions prior to 4.1.13. Reference: CVE-2022-26306 - LibreOffice
Patch / fix
- Apache Software Foundation Apache OpenOffice 4.1.13
Exploit prediction
0.98% chance of exploitation in the next 30 days, higher than 62% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.1 | 8.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Affected products
- Apache Software Foundation Apache OpenOffice
Classification
- Weakness
-
- CWE-330 Use of Insufficiently Random Values
References
-
openoffice.org
/security/cves/CVE-2022-37400.html
patch, product
-
openwall.com
/lists/oss-security/2022/08/13/1
mailing-list, third-party-advisory
Sources
- CVE List CVE-2022-37400
- NVD CVE-2022-37400
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.