CVE-2020-13958: 
Homebrew vulnerability analysis and mitigation

A vulnerability in Apache OpenOffice scripting events (CVE-2020-13958) was discovered that affects versions 4.0.0 through 4.1.7. The vulnerability allows an attacker to construct documents containing hyperlinks that point to executables on the target user's file system, which can be triggered unconditionally (NVD).

The vulnerability received a CVSS v3.1 base score of 7.8 (HIGH) with the vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. Under CVSS v2.0, it scored 9.3 (HIGH) with the vector (AV:N/AC:M/Au:N/C:C/I:C/A:C). The vulnerability specifically relates to the document event handler's ability to execute internal protocols and hyperlinks without proper restrictions (NVD).

The vulnerability allows attackers to achieve arbitrary code execution through crafted documents. When exploited, it can lead to complete compromise of confidentiality, integrity, and availability of the affected system, as indicated by the high CVSS scores (NVD).

The vulnerability requires user interaction to be exploited, as indicated by the UI:R component in the CVSS vector. The attack complexity is considered low (AC:L), and no privileges are required (PR:N) for exploitation (NVD).

The vulnerability was fixed in Apache OpenOffice version 4.1.8. In the fixed versions, no internal protocol may be called from the document event handler, and other hyperlinks require a control-click to be activated (NVD).