Cloudanix VulnDB

CVE-2022-3140

Medium · 6.3

CVSS

6.3

EPSS

6.9%

Published

Oct 11, 2022

CISA due date

—

Cloudanix analysis

Next patch cycle SSVC: Track

A flaw in how documents handle certain links lets attackers run hidden commands on a computer when someone opens a specially made file or clicks a link.

Exploitation
Requires User Interaction
Attacker needs
User Interaction
Complexity
Low
Impact
Remote Code Execution
Component
Application
Class
Command Injection
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Links using the 'vnd.libreoffice.command' scheme can invoke internal macros with arbitrary arguments, enabling arbitrary script execution without warnings when activated via clicks or document events.

Why it matters to the business

Attackers can run unauthorized code on user systems through crafted documents or links, risking data exposure or system compromise; the increasing EPSS trend and 1468 days since publication indicate ongoing exposure risk in environments using affected packages like pypa/pipenv.

How an attack unfolds

An attacker crafts a document or browser link leveraging the vnd.libreoffice.command scheme to trigger internal macros with malicious arguments; when the victim opens the document or an event activates the link, arbitrary scripts execute without user prompts, potentially chaining to further compromise.

How to fix it

Upgrade affected LibreOffice installations to 7.4.1 or later (for 7.4 series) or 7.3.6 or later (for 7.3 series); for pypa/pipenv (GIT) update to commit 87dc6e7c963d6be81474848c6a35aa431af8f645.

How to confirm the fix worked

Verify installed LibreOffice version is at or above the fixed releases; confirm pypa/pipenv (GIT) references commit 87dc6e7c963d6be81474848c6a35aa431af8f645; test that vnd.libreoffice.command links no longer execute arbitrary macros.

Typical attack path

  1. Identify or create a target document or web link
  2. Embed a vnd.libreoffice.command URI calling internal macros with attacker-controlled arguments
  3. Deliver the document or link to the victim (e.g., email, SharePoint)
  4. Victim interaction or document event activates the scheme
  5. Arbitrary script executes on the system

How to detect it

Search document metadata, logs, and browser history for activation of vnd.libreoffice.command URIs; inspect event logs for unexpected macro or script launches tied to document open events; review network or file access logs for post-activation anomalies.

  • vnd.libreoffice.command
  • libreoffice.command scheme
  • macro invocation via URI

What your security team should do

  • Prioritize patching LibreOffice and pypa/pipenv to the listed fixed versions immediately
  • Disable or restrict Office URI scheme handling if upgrades are delayed
  • Monitor for new documents containing vnd.libreoffice.command references
  • Review EPSS trend for rising exploit likelihood and adjust risk assessments

The record

LibreOffice supports Office URI Schemes to enable browser integration of LibreOffice with MS SharePoint server. An additional scheme 'vnd.libreoffice.command' specific to LibreOffice was added. In the affected versions of LibreOffice links using that scheme could be constructed to call internal macros with arbitrary arguments. Which when clicked on, or activated by document events, could result in arbitrary script execution without warning. This issue affects: The Document Foundation LibreOffice 7.4 versions prior to 7.4.1; 7.3 versions prior to 7.3.6.

Affected packages

Ecosystem Package Introduced Fixed
AlmaLinux:8 autocorr-af 0 1:6.4.7.2-12.el8_7.alma
AlmaLinux:8 autocorr-bg 0 1:6.4.7.2-12.el8_7.alma
AlmaLinux:8 autocorr-ca 0 1:6.4.7.2-12.el8_7.alma
AlmaLinux:8 autocorr-cs 0 1:6.4.7.2-12.el8_7.alma
AlmaLinux:8 autocorr-da 0 1:6.4.7.2-12.el8_7.alma
AlmaLinux:8 autocorr-de 0 1:6.4.7.2-12.el8_7.alma
AlmaLinux:8 autocorr-en 0 1:6.4.7.2-12.el8_7.alma
AlmaLinux:8 autocorr-es 0 1:6.4.7.2-12.el8_7.alma
AlmaLinux:8 autocorr-fa 0 1:6.4.7.2-12.el8_7.alma
AlmaLinux:8 autocorr-fi 0 1:6.4.7.2-12.el8_7.alma
AlmaLinux:8 autocorr-fr 0 1:6.4.7.2-12.el8_7.alma
AlmaLinux:8 autocorr-ga 0 1:6.4.7.2-12.el8_7.alma
AlmaLinux:8 autocorr-hr 0 1:6.4.7.2-12.el8_7.alma
AlmaLinux:8 autocorr-hu 0 1:6.4.7.2-12.el8_7.alma
AlmaLinux:8 autocorr-is 0 1:6.4.7.2-12.el8_7.alma
AlmaLinux:8 autocorr-it 0 1:6.4.7.2-12.el8_7.alma
AlmaLinux:8 autocorr-ja 0 1:6.4.7.2-12.el8_7.alma
AlmaLinux:8 autocorr-ko 0 1:6.4.7.2-12.el8_7.alma
AlmaLinux:8 autocorr-lb 0 1:6.4.7.2-12.el8_7.alma
AlmaLinux:8 autocorr-lt 0 1:6.4.7.2-12.el8_7.alma
AlmaLinux:8 autocorr-mn 0 1:6.4.7.2-12.el8_7.alma
AlmaLinux:8 autocorr-nl 0 1:6.4.7.2-12.el8_7.alma
AlmaLinux:8 autocorr-pl 0 1:6.4.7.2-12.el8_7.alma
AlmaLinux:8 autocorr-pt 0 1:6.4.7.2-12.el8_7.alma
AlmaLinux:8 autocorr-ro 0 1:6.4.7.2-12.el8_7.alma
AlmaLinux:8 autocorr-ru 0 1:6.4.7.2-12.el8_7.alma
AlmaLinux:8 autocorr-sk 0 1:6.4.7.2-12.el8_7.alma
AlmaLinux:8 autocorr-sl 0 1:6.4.7.2-12.el8_7.alma
AlmaLinux:8 autocorr-sr 0 1:6.4.7.2-12.el8_7.alma
AlmaLinux:8 autocorr-sv 0 1:6.4.7.2-12.el8_7.alma
AlmaLinux:8 autocorr-tr 0 1:6.4.7.2-12.el8_7.alma
AlmaLinux:8 autocorr-vi 0 1:6.4.7.2-12.el8_7.alma
AlmaLinux:8 autocorr-zh 0 1:6.4.7.2-12.el8_7.alma
AlmaLinux:8 libreoffice-base 0 1:6.4.7.2-12.el8_7.alma
AlmaLinux:8 libreoffice-calc 0 1:6.4.7.2-12.el8_7.alma
AlmaLinux:8 libreoffice-core 0 1:6.4.7.2-12.el8_7.alma
AlmaLinux:8 libreoffice-data 0 1:6.4.7.2-12.el8_7.alma
AlmaLinux:8 libreoffice-draw 0 1:6.4.7.2-12.el8_7.alma
AlmaLinux:8 libreoffice-emailmerge 0 1:6.4.7.2-12.el8_7.alma
AlmaLinux:8 libreoffice-filters 0 1:6.4.7.2-12.el8_7.alma
AlmaLinux:8 libreoffice-gdb-debug-support 0 1:6.4.7.2-12.el8_7.alma
AlmaLinux:8 libreoffice-graphicfilter 0 1:6.4.7.2-12.el8_7.alma
AlmaLinux:8 libreoffice-gtk3 0 1:6.4.7.2-12.el8_7.alma
AlmaLinux:8 libreoffice-help-ar 0 1:6.4.7.2-12.el8_7.alma
AlmaLinux:8 libreoffice-help-bg 0 1:6.4.7.2-12.el8_7.alma
AlmaLinux:8 libreoffice-help-bn 0 1:6.4.7.2-12.el8_7.alma
AlmaLinux:8 libreoffice-help-ca 0 1:6.4.7.2-12.el8_7.alma
AlmaLinux:8 libreoffice-help-cs 0 1:6.4.7.2-12.el8_7.alma
AlmaLinux:8 libreoffice-help-da 0 1:6.4.7.2-12.el8_7.alma
AlmaLinux:8 libreoffice-help-de 0 1:6.4.7.2-12.el8_7.alma
AlmaLinux:8 libreoffice-help-dz 0 1:6.4.7.2-12.el8_7.alma
AlmaLinux:8 libreoffice-help-el 0 1:6.4.7.2-12.el8_7.alma
AlmaLinux:8 libreoffice-help-en 0 1:6.4.7.2-12.el8_7.alma
AlmaLinux:8 libreoffice-help-es 0 1:6.4.7.2-12.el8_7.alma
AlmaLinux:8 libreoffice-help-et 0 1:6.4.7.2-12.el8_7.alma
AlmaLinux:8 libreoffice-help-eu 0 1:6.4.7.2-12.el8_7.alma
AlmaLinux:8 libreoffice-help-fi 0 1:6.4.7.2-12.el8_7.alma
AlmaLinux:8 libreoffice-help-fr 0 1:6.4.7.2-12.el8_7.alma
AlmaLinux:8 libreoffice-help-gl 0 1:6.4.7.2-12.el8_7.alma
AlmaLinux:8 libreoffice-help-gu 0 1:6.4.7.2-12.el8_7.alma
AlmaLinux:8 libreoffice-help-he 0 1:6.4.7.2-12.el8_7.alma
AlmaLinux:8 libreoffice-help-hi 0 1:6.4.7.2-12.el8_7.alma
AlmaLinux:8 libreoffice-help-hr 0 1:6.4.7.2-12.el8_7.alma
AlmaLinux:8 libreoffice-help-hu 0 1:6.4.7.2-12.el8_7.alma
AlmaLinux:8 libreoffice-help-id 0 1:6.4.7.2-12.el8_7.alma
AlmaLinux:8 libreoffice-help-it 0 1:6.4.7.2-12.el8_7.alma
AlmaLinux:8 libreoffice-help-ja 0 1:6.4.7.2-12.el8_7.alma
AlmaLinux:8 libreoffice-help-ko 0 1:6.4.7.2-12.el8_7.alma
AlmaLinux:8 libreoffice-help-lt 0 1:6.4.7.2-12.el8_7.alma
AlmaLinux:8 libreoffice-help-lv 0 1:6.4.7.2-12.el8_7.alma
AlmaLinux:8 libreoffice-help-nb 0 1:6.4.7.2-12.el8_7.alma
AlmaLinux:8 libreoffice-help-nl 0 1:6.4.7.2-12.el8_7.alma
AlmaLinux:8 libreoffice-help-nn 0 1:6.4.7.2-12.el8_7.alma
AlmaLinux:8 libreoffice-help-pl 0 1:6.4.7.2-12.el8_7.alma
AlmaLinux:8 libreoffice-help-pt-BR 0 1:6.4.7.2-12.el8_7.alma
AlmaLinux:8 libreoffice-help-pt-PT 0 1:6.4.7.2-12.el8_7.alma
AlmaLinux:8 libreoffice-help-ro 0 1:6.4.7.2-12.el8_7.alma
AlmaLinux:8 libreoffice-help-ru 0 1:6.4.7.2-12.el8_7.alma
AlmaLinux:8 libreoffice-help-si 0 1:6.4.7.2-12.el8_7.alma
AlmaLinux:8 libreoffice-help-sk 0 1:6.4.7.2-12.el8_7.alma
AlmaLinux:8 libreoffice-help-sl 0 1:6.4.7.2-12.el8_7.alma
AlmaLinux:8 libreoffice-help-sv 0 1:6.4.7.2-12.el8_7.alma
AlmaLinux:8 libreoffice-help-ta 0 1:6.4.7.2-12.el8_7.alma
AlmaLinux:8 libreoffice-help-tr 0 1:6.4.7.2-12.el8_7.alma
AlmaLinux:8 libreoffice-help-uk 0 1:6.4.7.2-12.el8_7.alma
AlmaLinux:8 libreoffice-help-zh-Hans 0 1:6.4.7.2-12.el8_7.alma
AlmaLinux:8 libreoffice-help-zh-Hant 0 1:6.4.7.2-12.el8_7.alma
AlmaLinux:8 libreoffice-impress 0 1:6.4.7.2-12.el8_7.alma
AlmaLinux:8 libreoffice-langpack-af 0 1:6.4.7.2-12.el8_7.alma
AlmaLinux:8 libreoffice-langpack-ar 0 1:6.4.7.2-12.el8_7.alma
AlmaLinux:8 libreoffice-langpack-as 0 1:6.4.7.2-12.el8_7.alma
AlmaLinux:8 libreoffice-langpack-bg 0 1:6.4.7.2-12.el8_7.alma
AlmaLinux:8 libreoffice-langpack-bn 0 1:6.4.7.2-12.el8_7.alma
AlmaLinux:8 libreoffice-langpack-br 0 1:6.4.7.2-12.el8_7.alma
AlmaLinux:8 libreoffice-langpack-ca 0 1:6.4.7.2-12.el8_7.alma
AlmaLinux:8 libreoffice-langpack-cs 0 1:6.4.7.2-12.el8_7.alma
AlmaLinux:8 libreoffice-langpack-cy 0 1:6.4.7.2-12.el8_7.alma
AlmaLinux:8 libreoffice-langpack-da 0 1:6.4.7.2-12.el8_7.alma
AlmaLinux:8 libreoffice-langpack-de 0 1:6.4.7.2-12.el8_7.alma
AlmaLinux:8 libreoffice-langpack-dz 0 1:6.4.7.2-12.el8_7.alma
AlmaLinux:8 libreoffice-langpack-el 0 1:6.4.7.2-12.el8_7.alma
AlmaLinux:8 libreoffice-langpack-en 0 1:6.4.7.2-12.el8_7.alma
AlmaLinux:8 libreoffice-langpack-es 0 1:6.4.7.2-12.el8_7.alma
AlmaLinux:8 libreoffice-langpack-et 0 1:6.4.7.2-12.el8_7.alma
AlmaLinux:8 libreoffice-langpack-eu 0 1:6.4.7.2-12.el8_7.alma
AlmaLinux:8 libreoffice-langpack-fa 0 1:6.4.7.2-12.el8_7.alma
AlmaLinux:8 libreoffice-langpack-fi 0 1:6.4.7.2-12.el8_7.alma
AlmaLinux:8 libreoffice-langpack-fr 0 1:6.4.7.2-12.el8_7.alma
AlmaLinux:8 libreoffice-langpack-ga 0 1:6.4.7.2-12.el8_7.alma
AlmaLinux:8 libreoffice-langpack-gl 0 1:6.4.7.2-12.el8_7.alma
AlmaLinux:8 libreoffice-langpack-gu 0 1:6.4.7.2-12.el8_7.alma
AlmaLinux:8 libreoffice-langpack-he 0 1:6.4.7.2-12.el8_7.alma
AlmaLinux:8 libreoffice-langpack-hi 0 1:6.4.7.2-12.el8_7.alma
AlmaLinux:8 libreoffice-langpack-hr 0 1:6.4.7.2-12.el8_7.alma
AlmaLinux:8 libreoffice-langpack-hu 0 1:6.4.7.2-12.el8_7.alma
AlmaLinux:8 libreoffice-langpack-id 0 1:6.4.7.2-12.el8_7.alma
AlmaLinux:8 libreoffice-langpack-it 0 1:6.4.7.2-12.el8_7.alma
AlmaLinux:8 libreoffice-langpack-ja 0 1:6.4.7.2-12.el8_7.alma
AlmaLinux:8 libreoffice-langpack-kk 0 1:6.4.7.2-12.el8_7.alma
AlmaLinux:8 libreoffice-langpack-kn 0 1:6.4.7.2-12.el8_7.alma
AlmaLinux:8 libreoffice-langpack-ko 0 1:6.4.7.2-12.el8_7.alma
AlmaLinux:8 libreoffice-langpack-lt 0 1:6.4.7.2-12.el8_7.alma
AlmaLinux:8 libreoffice-langpack-lv 0 1:6.4.7.2-12.el8_7.alma
AlmaLinux:8 libreoffice-langpack-mai 0 1:6.4.7.2-12.el8_7.alma
AlmaLinux:8 libreoffice-langpack-ml 0 1:6.4.7.2-12.el8_7.alma
AlmaLinux:8 libreoffice-langpack-mr 0 1:6.4.7.2-12.el8_7.alma
AlmaLinux:8 libreoffice-langpack-nb 0 1:6.4.7.2-12.el8_7.alma
AlmaLinux:8 libreoffice-langpack-nl 0 1:6.4.7.2-12.el8_7.alma
AlmaLinux:8 libreoffice-langpack-nn 0 1:6.4.7.2-12.el8_7.alma
AlmaLinux:8 libreoffice-langpack-nr 0 1:6.4.7.2-12.el8_7.alma
AlmaLinux:8 libreoffice-langpack-nso 0 1:6.4.7.2-12.el8_7.alma
AlmaLinux:8 libreoffice-langpack-or 0 1:6.4.7.2-12.el8_7.alma
AlmaLinux:8 libreoffice-langpack-pa 0 1:6.4.7.2-12.el8_7.alma
AlmaLinux:8 libreoffice-langpack-pl 0 1:6.4.7.2-12.el8_7.alma
AlmaLinux:8 libreoffice-langpack-pt-BR 0 1:6.4.7.2-12.el8_7.alma
AlmaLinux:8 libreoffice-langpack-pt-PT 0 1:6.4.7.2-12.el8_7.alma
AlmaLinux:8 libreoffice-langpack-ro 0 1:6.4.7.2-12.el8_7.alma
AlmaLinux:8 libreoffice-langpack-ru 0 1:6.4.7.2-12.el8_7.alma
AlmaLinux:8 libreoffice-langpack-si 0 1:6.4.7.2-12.el8_7.alma
AlmaLinux:8 libreoffice-langpack-sk 0 1:6.4.7.2-12.el8_7.alma
AlmaLinux:8 libreoffice-langpack-sl 0 1:6.4.7.2-12.el8_7.alma
AlmaLinux:8 libreoffice-langpack-sr 0 1:6.4.7.2-12.el8_7.alma
AlmaLinux:8 libreoffice-langpack-ss 0 1:6.4.7.2-12.el8_7.alma
AlmaLinux:8 libreoffice-langpack-st 0 1:6.4.7.2-12.el8_7.alma
AlmaLinux:8 libreoffice-langpack-sv 0 1:6.4.7.2-12.el8_7.alma
AlmaLinux:8 libreoffice-langpack-ta 0 1:6.4.7.2-12.el8_7.alma
AlmaLinux:8 libreoffice-langpack-te 0 1:6.4.7.2-12.el8_7.alma
AlmaLinux:8 libreoffice-langpack-th 0 1:6.4.7.2-12.el8_7.alma
AlmaLinux:8 libreoffice-langpack-tn 0 1:6.4.7.2-12.el8_7.alma
AlmaLinux:8 libreoffice-langpack-tr 0 1:6.4.7.2-12.el8_7.alma
AlmaLinux:8 libreoffice-langpack-ts 0 1:6.4.7.2-12.el8_7.alma
AlmaLinux:8 libreoffice-langpack-uk 0 1:6.4.7.2-12.el8_7.alma
AlmaLinux:8 libreoffice-langpack-ve 0 1:6.4.7.2-12.el8_7.alma
AlmaLinux:8 libreoffice-langpack-xh 0 1:6.4.7.2-12.el8_7.alma
AlmaLinux:8 libreoffice-langpack-zh-Hans 0 1:6.4.7.2-12.el8_7.alma
AlmaLinux:8 libreoffice-langpack-zh-Hant 0 1:6.4.7.2-12.el8_7.alma
AlmaLinux:8 libreoffice-langpack-zu 0 1:6.4.7.2-12.el8_7.alma
AlmaLinux:8 libreoffice-math 0 1:6.4.7.2-12.el8_7.alma
AlmaLinux:8 libreoffice-ogltrans 0 1:6.4.7.2-12.el8_7.alma
AlmaLinux:8 libreoffice-opensymbol-fonts 0 1:6.4.7.2-12.el8_7.alma
AlmaLinux:8 libreoffice-pdfimport 0 1:6.4.7.2-12.el8_7.alma
AlmaLinux:8 libreoffice-pyuno 0 1:6.4.7.2-12.el8_7.alma
AlmaLinux:8 libreoffice-sdk 0 1:6.4.7.2-12.el8_7.alma
AlmaLinux:8 libreoffice-sdk-doc 0 1:6.4.7.2-12.el8_7.alma
AlmaLinux:8 libreoffice-ure 0 1:6.4.7.2-12.el8_7.alma
AlmaLinux:8 libreoffice-ure-common 0 1:6.4.7.2-12.el8_7.alma
AlmaLinux:8 libreoffice-wiki-publisher 0 1:6.4.7.2-12.el8_7.alma
AlmaLinux:8 libreoffice-writer 0 1:6.4.7.2-12.el8_7.alma
AlmaLinux:8 libreoffice-x11 0 1:6.4.7.2-12.el8_7.alma
AlmaLinux:8 libreoffice-xsltfilter 0 1:6.4.7.2-12.el8_7.alma
AlmaLinux:8 libreofficekit 0 1:6.4.7.2-12.el8_7.alma
AlmaLinux:9 autocorr-af 0 1:7.1.8.1-8.el9_1.alma
AlmaLinux:9 autocorr-bg 0 1:7.1.8.1-8.el9_1.alma
AlmaLinux:9 autocorr-ca 0 1:7.1.8.1-8.el9_1.alma
AlmaLinux:9 autocorr-cs 0 1:7.1.8.1-8.el9_1.alma
AlmaLinux:9 autocorr-da 0 1:7.1.8.1-8.el9_1.alma
AlmaLinux:9 autocorr-de 0 1:7.1.8.1-8.el9_1.alma
AlmaLinux:9 autocorr-dsb 0 1:7.1.8.1-8.el9_1.alma
AlmaLinux:9 autocorr-el 0 1:7.1.8.1-8.el9_1.alma
AlmaLinux:9 autocorr-en 0 1:7.1.8.1-8.el9_1.alma
AlmaLinux:9 autocorr-es 0 1:7.1.8.1-8.el9_1.alma
AlmaLinux:9 autocorr-fa 0 1:7.1.8.1-8.el9_1.alma
AlmaLinux:9 autocorr-fi 0 1:7.1.8.1-8.el9_1.alma
AlmaLinux:9 autocorr-fr 0 1:7.1.8.1-8.el9_1.alma
AlmaLinux:9 autocorr-ga 0 1:7.1.8.1-8.el9_1.alma
AlmaLinux:9 autocorr-hr 0 1:7.1.8.1-8.el9_1.alma
AlmaLinux:9 autocorr-hsb 0 1:7.1.8.1-8.el9_1.alma
AlmaLinux:9 autocorr-hu 0 1:7.1.8.1-8.el9_1.alma
AlmaLinux:9 autocorr-is 0 1:7.1.8.1-8.el9_1.alma
AlmaLinux:9 autocorr-it 0 1:7.1.8.1-8.el9_1.alma
AlmaLinux:9 autocorr-ja 0 1:7.1.8.1-8.el9_1.alma
AlmaLinux:9 autocorr-ko 0 1:7.1.8.1-8.el9_1.alma
AlmaLinux:9 autocorr-lb 0 1:7.1.8.1-8.el9_1.alma
AlmaLinux:9 autocorr-lt 0 1:7.1.8.1-8.el9_1.alma
AlmaLinux:9 autocorr-mn 0 1:7.1.8.1-8.el9_1.alma
AlmaLinux:9 autocorr-nl 0 1:7.1.8.1-8.el9_1.alma
AlmaLinux:9 autocorr-pl 0 1:7.1.8.1-8.el9_1.alma
AlmaLinux:9 autocorr-pt 0 1:7.1.8.1-8.el9_1.alma
AlmaLinux:9 autocorr-ro 0 1:7.1.8.1-8.el9_1.alma
AlmaLinux:9 autocorr-ru 0 1:7.1.8.1-8.el9_1.alma

Related vulnerabilities