CVE-2025-64401

Apache OpenOffice documents can contain links. A missing Authorization vulnerability in Apache OpenOffice allowed an attacker to craft a document that would cause external links to be loaded without prompt. In the affected versions of Apache OpenOffice, documents that used "floating frames" linked to external files would load the contents of those frames without prompting the user for permission to do so. This issue affects Apache OpenOffice: through 4.1.15. Users are recommended to upgrade to version 4.1.16, which fixes the issue. The LibreOffice suite reported this issue as CVE-2023-2255

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://lists.apache.org/thread/o00dtgvhr9tx8r4y8vf6y2mg7nn6mx6c	Mailing List Vendor Advisory
https://www.openoffice.org/security/cves/CVE-2025-64401.html	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:apache:openoffice:*:*:*:*:*:*:*:*

History

18 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) Los documentos de Apache OpenOffice pueden contener enlaces. Una Vulnerabilidad de falta de autorización en Apache OpenOffice permitió a un atacante crear un documento que causaría que los enlaces externos se cargaran sin aviso. En las versiones afectadas de Apache OpenOffice, los documentos que utilizaban “marcos flotantes” vinculados a archivos externos cargarían el contenido de esos marcos sin solicitar al usuario permiso para hacerlo. Este problema afecta a Apache OpenOffice: hasta la versión 4.1.15. Se recomienda a los usuarios actualizar a la versión 4.1.16, que corrige el problema. La suite LibreOffice informó de este problema como CVE-2023-2255.

Information

Published : 2025-11-12 09:15

Updated : 2026-10-18 20:10

NVD link : CVE-2025-64401

Mitre link : CVE-2025-64401

CVE.ORG link : CVE-2025-64401

JSON object : View

Products Affected

apache

openoffice

CWE

CWE-862

Missing Authorization

{"id": "CVE-2025-64401", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-64401", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-11-12T14:50:27.226997Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security@apache.org", "affectedData": [{"vendor": "Apache Software Foundation", "product": "Apache OpenOffice", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "4.1.15"}], "defaultStatus": "unaffected"}]}], "published": "2025-11-12T09:15:40.997", "references": [{"url": "https://lists.apache.org/thread/o00dtgvhr9tx8r4y8vf6y2mg7nn6mx6c", "tags": ["Mailing List", "Vendor Advisory"], "source": "security@apache.org"}, {"url": "https://www.openoffice.org/security/cves/CVE-2025-64401.html", "tags": ["Vendor Advisory"], "source": "security@apache.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@apache.org", "description": [{"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "Apache OpenOffice documents can contain links. A missing Authorization vulnerability in Apache OpenOffice\u00a0allowed an attacker to craft a document that would cause external links \nto be loaded without prompt.\u00a0In the affected versions of Apache OpenOffice, documents that used \"floating frames\" linked to external files would \nload the contents of those frames without prompting the user for \npermission to do so.\n\nThis issue affects Apache OpenOffice: through 4.1.15.\n\nUsers are recommended to upgrade to version 4.1.16, which fixes the issue.\n\nThe LibreOffice suite reported this issue as\u00a0CVE-2023-2255"}, {"lang": "es", "value": "Los documentos de Apache OpenOffice pueden contener enlaces. Una Vulnerabilidad de falta de autorizaci\u00f3n en Apache OpenOffice permiti\u00f3 a un atacante crear un documento que causar\u00eda que los enlaces externos se cargaran sin aviso. En las versiones afectadas de Apache OpenOffice, los documentos que utilizaban \u201cmarcos flotantes\u201d vinculados a archivos externos cargar\u00edan el contenido de esos marcos sin solicitar al usuario permiso para hacerlo.\n\nEste problema afecta a Apache OpenOffice: hasta la versi\u00f3n 4.1.15.\n\nSe recomienda a los usuarios actualizar a la versi\u00f3n 4.1.16, que corrige el problema.\n\nLa suite LibreOffice inform\u00f3 de este problema como CVE-2023-2255."}], "lastModified": "2026-10-18T20:10:00.110", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:apache:openoffice:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6B08F777-BF20-4E1A-B3E1-42966B5AE2CF", "versionEndExcluding": "4.1.16"}], "operator": "OR"}]}], "sourceIdentifier": "security@apache.org"}