PT-2021-23955 · Collabora · Collabora Online

Timarp · Published 2021-12-13 · Updated 2021-12-15 · CVE-2021-43817

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:N

Name of the Vulnerable Software and Affected Versions: Collabora Online versions prior to 4.2.20 Collabora Online versions prior to 6.4.16

Description: A reflected XSS vulnerability was found in Collabora Online, a collaborative online office suite based on LibreOffice technology. An attacker could inject unescaped HTML into a variable as they created the Collabora Online iframe, and execute scripts inside the context of the Collabora Online iframe. This would give access to a small set of user settings stored in the browser, as well as the session's authentication token which was also passed in at iframe creation time.

Recommendations: For Collabora Online versions prior to 4.2.20, upgrade to Collabora Online 4.2.20 or higher. For Collabora Online versions prior to 6.4.16, upgrade to Collabora Online 6.4.16 or higher.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-43817

GHSA-7F6H-V9MX-58Q9

Affected Products

Collabora Online

References · 4

• https://osv.dev/vulnerability/CVE-2021-43817 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-43817 · Security Note
• https://github.com/CollaboraOnline/online/security/advisories/GHSA-7f6h-v9mx-58q9 · Note
• https://t.me/cibsecurity/33881 · Telegram Post