CVE-2025-64403
BaseFortify
Publication date: 2025-11-12
Last updated on: 2025-11-13
Assigner: Apache Software Foundation
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| apache | openoffice | to 4.1.16 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-862 | The product does not perform an authorization check when an actor attempts to access a resource or perform an action. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in Apache OpenOffice Calc (up to version 4.1.15) is due to a missing authorization check that allows an attacker to create a malicious spreadsheet containing links to external data sources. When a user opens such a document, these external links are loaded automatically without any prompt or user consent, potentially leading to unauthorized data access or other malicious actions. The issue is fixed in version 4.1.16. [1, 3]
How can this vulnerability impact me? :
The vulnerability can impact you by allowing unauthorized loading of external data sources when opening a crafted spreadsheet, which may lead to unauthorized data access or exposure to malicious content without your knowledge or consent. This could compromise your data privacy or security. [1, 3]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by identifying Apache OpenOffice Calc spreadsheet files (versions up to 4.1.15) that contain links to external data sources which load automatically without user prompt. However, no specific detection commands or network signatures are provided in the available resources. Users should inspect spreadsheet files for external data source links and verify the OpenOffice version in use. [1, 3]
What immediate steps should I take to mitigate this vulnerability?
The immediate step to mitigate this vulnerability is to upgrade Apache OpenOffice to version 4.1.16 or later, as this version fixes the missing authorization check issue. Until the upgrade is applied, users should avoid opening untrusted Calc spreadsheet files that may contain external data source links. [1, 3]