An authorization bypass in Apache OpenOffice enables unauthorized loading of external content, posing a significant risk of information disclosure or malicious content execution.

This is a missing authorization vulnerability (CWE-862) where the application fails to prompt the user before loading external content via floating frames. The vulnerability is exploitable by an unauthenticated attacker who can successfully entice a user to open a specially crafted document.

The ability to load external content without user interaction undermines the security posture of document processing workflows. While the CVSS score of 7.5 indicates a high severity, the primary risk involves the potential for unauthorized data access or the facilitation of further exploitation through malicious external resources. Organizations relying on OpenOffice for document management should prioritize remediation to prevent potential data exfiltration or phishing-related incidents.

Immediate Action: Upgrade all instances of Apache OpenOffice to version 4.1.16 or later to address the authorization flaw.

Proactive Monitoring: Review file access logs and network traffic for suspicious connections originating from the OpenOffice application to unknown or untrusted external domains.

Compensating Controls: Implement network-level egress filtering to restrict unauthorized external connections from workstations, which can limit the impact if a malicious document is opened.

Public Exploit Available: No (exploit_available: unknown)

Given the ease of exploitation and the potential for unauthorized external content loading, organizations must treat this vulnerability with high priority. We strongly recommend immediate deployment of the 4.1.16 patch across all endpoints to eliminate the risk of exploitation.