CVE-2022-38745— Apache OpenOffice: Empty entry in Java class path
Quick assessment
Affected
Apache Software Foundation Apache OpenOffice
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Apache OpenOffice是美国阿帕奇（Apache）基金会的一款开源的办公软件套件。该套件包含文本文档、电子表格、演示文稿、绘图、数据库等。 Apache OpenOffice 4.1.14 之前版本存在安全漏洞，该漏洞源于可以向 Java 类路径添加一个空条目，这可能导致从当前目录运行任意 Java 代码。
Possible ATT&CK Techniques 2 AI
T1059 · Command and Scripting Interpreter T1203 · Exploitation for Client Execution
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2022-38745
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Apache OpenOffice: Empty entry in Java class path
Source: CVE Program / CVE List V5
Vulnerability Description
Apache OpenOffice versions before 4.1.14 may be configured to add an empty entry to the Java class path. This may lead to run arbitrary Java code from the current directory.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
对生成代码的控制不恰当(代码注入)
Source: CVE Program / CVE List V5
Vulnerability Title
Apache OpenOffice 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Apache OpenOffice是美国阿帕奇（Apache）基金会的一款开源的办公软件套件。该套件包含文本文档、电子表格、演示文稿、绘图、数据库等。 Apache OpenOffice 4.1.14 之前版本存在安全漏洞，该漏洞源于可以向 Java 类路径添加一个空条目，这可能导致从当前目录运行任意 Java 代码。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Apache Software Foundation | Apache OpenOffice | 0 ~ 4.1.14 | - |
|
II. Public POCs for CVE-2022-38745
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2022-38745
请登录查看更多情报信息。
Mailing List Discussions for CVE-2022-38745 (1)
-
https://lists.apache.org/thread/q3noq7m681kvtb29m28x74q8cnwnzzo0 vendor-advisory
Other References for CVE-2022-38745 (1)
IV. Related Vulnerabilities
Same product: Apache OpenOffice
-
CVE-2025-64407
Apache OpenOffice: URL fetching can be used to exfiltrate ar -
CVE-2025-64406
Apache OpenOffice: Possible memory corruption during CSV imp -
CVE-2025-64405
Apache OpenOffice: Remote documents loaded without prompt vi -
CVE-2025-64404
Apache OpenOffice: Remote documents loaded without prompt vi -
CVE-2025-64403
Apache OpenOffice: Remote documents loaded without prompt vi
Same vendor: Apache Software Foundation
-
CVE-2026-94276
Apache APISIX: Openid-connect introspection validation issue -
CVE-2026-94269
Apache APISIX: Servlet-style normalization creates a route/u -
CVE-2026-94250
Apache APISIX: Batch response aggregation can exhaust worker -
CVE-2026-94220
Apache APISIX: session fixation issue in feishu-auth and din -
CVE-2026-94212
Apache APISIX: unauthenticated impersonation issue in saml-a
Same weakness: CWE-94
-
CVE-2026-92966
Appointment Booking Plugin <= 5.7.0 - Unauthenticated Arbitr -
CVE-2026-102130
Kiteworks Email Protection Gateway Remote Code Execution -
CVE-2026-102131
Kiteworks Email Protection Gateway Improper Handling of Case -
CVE-2026-55107
Kobako Vulnerable to Sandbox Escape: guest eval reaches host -
CVE-2026-96349
WordPress SiteSkite plugin <= 2.1.8 - Remote Code Execution
V. Comments for CVE-2022-38745
No comments yet