PT-2023-12450 · Unknown · Onlyoffice

Iain Wallace · Publicado 2023-01-23 · Atualizado 2025-07-03 · CVE-2021-43446

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions ONLYOFFICE versions prior to the version released after 2021-11-08

Description The issue concerns a Cross Site Scripting (XSS) problem. The "macros" feature of the document editor in ONLYOFFICE allows malicious cross site scripting payloads to be used.

Recommendations For versions prior to the version released after 2021-11-08, consider disabling the "macros" feature of the document editor until a patch is available. Restrict access to the document editor to minimize the risk of exploitation.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2021-43446

Produtos afetados

Onlyoffice

Referências · 14

• 🔥 https://labs.nettitude.com/blog/exploiting-onlyoffice-web-sockets-for-unauthenticated-remote-code-execution · Exploit
• https://github.com/ONLYOFFICE/server · Nota
• https://t.me/cvenotify/117384 · Publicação no Telegram
• https://onlyoffice.com · Aviso do Fabricante
• https://t.me/cvedetector/5134 · Publicação no Telegram
• https://t.me/cvenotify/43187 · Publicação no Telegram
• https://t.me/cvenotify/93988 · Publicação no Telegram
• https://t.me/cvenotify/95452 · Publicação no Telegram
• https://t.me/cvedetector/5139 · Publicação no Telegram
• https://t.me/cvenotify/127558 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2021-43446 · Nota de Segurança
• https://t.me/cvenotify/93989 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2021-43446 · Aviso do Fabricante
• https://t.me/cvenotify/93949 · Publicação no Telegram