CVE-2021-43817CWE-79

Reflected Cross-Site-Scripting vulnerability in Collabora Online

High · published December 13, 2021

CVSS v3.1
8.2
EPSS
1%
Percentile
51.3
In the wild
Unconfirmed
What it is

Collabora Online is a collaborative online office suite based on LibreOffice technology. In affected versions a reflected XSS vulnerability was found in Collabora Online. An attacker could inject unescaped HTML into a variable as they created the Collabora Online iframe, and execute scripts inside the context of the Collabora Online iframe. This would give access to a small set of user settings stored in the browser, as well as the session's authentication token which was also passed in at iframe creation time. Users should upgrade to Collabora Online 6.4.16 or higher or Collabora Online 4.2.20 or higher. Collabora Online Development Edition 21.11 is not affected.

The record
Technical detail
CVSS v3.1
8.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00667 · 51.3th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2021-12-13T19:45Z
EPSS history
Timeline
  • 13 DEC 19:45Z
    Reflected Cross-Site-Scripting vulnerability in Collabora Online
    cvelistv5