CVE-2008-4937: openoffice openoffice.org Link Following

Vulnerability summary

CVE-2008-4937 is a low (CVSS 2.6) Link Following vulnerability in openoffice openoffice.org. EPSS estimates a 0.45% chance of exploitation in the next 30 days, higher than 37.3% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 05-11-2008
   PublishedVulnerability first disclosed.
2. 07-08-2024
   Last modifiedVulnerability information updated.

Description

senddoc in OpenOffice.org (OOo) 2.4.1 allows local users to overwrite arbitrary files via a symlink attack on a /tmp/log.obr.##### temporary file.

• CWE-59Improper Link Resolution Before File Access ('Link Following')The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.