Security readout for executives and security teams
Plain-English summary
Malicious OpenOffice documents could abuse scripting events to launch hyperlinks to executables already on a user’s filesystem. This is a user-workstation risk tied to opening untrusted documents. The bundle does not provide a CVSS score or evidence of active exploitation.
Executive priority
Treat as a targeted workstation hardening issue. Prioritize teams that receive external documents, but do not escalate as emergency without evidence of active exploitation or broader exposure.
Technical view
Apache OpenOffice 4.0 through 4.1.7 allowed document event handlers to trigger internal protocol hyperlinks unconditionally, including links to local executables. Fixed behavior blocks internal protocol calls from document event handlers and requires control-click for other hyperlinks.
Likely exposure
Exposure is likely limited to endpoints where Apache OpenOffice 4.0 through 4.1.7 is installed and users open untrusted documents. Server exposure is not indicated by the supplied sources.
Exploitation context
The supplied sources do not show KEV listing or active exploitation. Abuse appears to require a crafted document and a referenced executable path on the target user’s filesystem.
Researcher notes
Key missing data includes CVSS, CWE mapping, exploit telemetry, and the exact fixed release in the provided bundle. Analysis should stay scoped to Apache OpenOffice, document event handlers, internal protocol hyperlinks, and affected versions 4.0 to 4.1.7.
Mitigation direction
- Inventory endpoints for Apache OpenOffice 4.0 through 4.1.7.
- Move affected installations to a fixed Apache OpenOffice version per Apache guidance.
- Restrict opening untrusted OpenOffice documents until remediation is complete.
- Use email and web filtering to reduce delivery of suspicious office documents.
Validation and detection
- Confirm installed Apache OpenOffice versions across managed endpoints.
- Check whether affected users handle externally supplied OpenOffice documents.
- Verify upgraded clients no longer fall within versions 4.0 through 4.1.7.
- Review endpoint detections for suspicious document-triggered process launches.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2020-13958 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://lists.apache.org/thread.html/r6b2f48cf6c4aad4ebd13f90033162276b0ccae63bea2d3d89cdaf355%40%3Cannounce.openoffice.apache.org%3ECVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.