CVE-2021-30245

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

The project received a report that all versions of Apache OpenOffice through 4.1.8 can open non-http(s) hyperlinks. The problem has existed since about 2006 and the issue is also in 4.1.9. If the link is specifically crafted this could lead to untrusted code execution. It is always best practice to be careful opening documents from unknown and unverified sources. The mitigation in Apache OpenOffice 4.1.10 (unreleased) assures that a security warning is displayed giving the user the option of continuing to open the hyperlink.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-610

Affected software

No affected versions have been published.

Timeline

Published: Apr 15, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-302469.1In the jsrsasign package through 10.1.13 for Node.js, some invalid RSA PKCS#1 v1.5 signatures are mistakenly recognized to be valid. NOTE: t CVE-2021-30258.8Invision Community IPS Community Suite before 4.5.4.2 allows SQL Injection via the Downloads REST API (the sortDir parameter in a sortBy=pop CVE-2021-302547.8Possible buffer overflow due to improper input validation in factory calibration and test DIAG command in Snapdragon Auto, Snapdragon Comput CVE-2021-302557.8Possible buffer overflow due to improper input validation in PDM DIAG command in FTM in Snapdragon Auto, Snapdragon Compute, Snapdragon Conn CVE-2021-302567.8Possible stack overflow due to improper validation of camera name length before copying the name in VR Service in Snapdragon Compute, Snapdr CVE-2021-302577.8Possible out of bound read or write in VR service due to lack of validation of DSP selection values in Snapdragon Compute, Snapdragon Connec CVE-2021-302587.8Possible buffer overflow due to improper size calculation of payload received in VR service in Snapdragon Auto, Snapdragon Compute, Snapdrag CVE-2021-302597.8Possible out of bound access due to improper validation of function table entries in Snapdragon Auto, Snapdragon Compute, Snapdragon Connect CVE-2021-30266.1Invision Community IPS Community Suite before 4.5.4.2 allows XSS during the quoting of a post or comment.CVE-2021-302607.8Possible Integer overflow to buffer overflow issue can occur due to improper validation of input parameters when extscan hostlist configurat CVE-2021-302617.8Possible integer and heap overflow due to lack of input command size validation while handling beacon template update command from HLOS in S CVE-2021-302627.8Improper validation of a socket state when socket events are being sent to clients can lead to invalid access of memory in Snapdragon Auto,