What’s Vulnerable › Vulnerabilities

CVE-2022-3140: Macro URL arbitrary script execution

• Severity: medium (CVSS 6.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 6.9% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-10-11 · updated 2026-06-17
• Weakness: CWE-20

Description

LibreOffice supports Office URI Schemes to enable browser integration of LibreOffice with MS SharePoint server. An additional scheme 'vnd.libreoffice.command' specific to LibreOffice was added. In the affected versions of LibreOffice links using that scheme could be constructed to call internal macros with arbitrary arguments. Which when clicked on, or activated by document events, could result in arbitrary script execution without warning. This issue affects: The Document Foundation LibreOffice 7.4 versions prior to 7.4.1; 7.3 versions prior to 7.3.6.

Affected products

• Debian Linux: 11.0
• Fedoraproject Fedora: 35
• The Document Foundation LibreOffice: from 7.3.0 before 7.3.6; 7.4.0 — fixed in 7.3.6

How to fix

Upgrade to a fixed version: The Document Foundation LibreOffice 7.3.6. Check the vendor advisory for mitigations.

References

• https://lists.debian.org/debian-lts-announce/2023/03/msg00022.html
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TORANVTIWWBH3DNJR4UZATAG67KZOH32/
• https://security.gentoo.org/glsa/202212-04
• https://www.debian.org/security/2022/dsa-5252
• https://www.libreoffice.org/about-us/security/advisories/CVE-2022-3140
• https://lists.debian.org/debian-lts-announce/2023/03/msg00022.html
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TORANVTIWWBH3DNJR4UZATAG67KZOH32/
• https://security.gentoo.org/glsa/202212-04
• https://www.debian.org/security/2022/dsa-5252
• https://www.libreoffice.org/about-us/security/advisories/CVE-2022-3140

Get alerted when CVE-2022-3140 or the next vulnerability affects your stack