PT-2023-12450 · Unknown · Onlyoffice

Iain Wallace · Published 2023-01-23 · Updated 2025-07-03 · CVE-2021-43446

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions ONLYOFFICE versions prior to the version released after 2021-11-08

Description The issue concerns a Cross Site Scripting (XSS) problem. The "macros" feature of the document editor in ONLYOFFICE allows malicious cross site scripting payloads to be used.

Recommendations For versions prior to the version released after 2021-11-08, consider disabling the "macros" feature of the document editor until a patch is available. Restrict access to the document editor to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-43446

Affected Products

Onlyoffice

References · 14

• 🔥 https://labs.nettitude.com/blog/exploiting-onlyoffice-web-sockets-for-unauthenticated-remote-code-execution · Exploit
• https://onlyoffice.com · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-43446 · Security Note
• https://osv.dev/vulnerability/CVE-2021-43446 · Vendor Advisory
• https://github.com/ONLYOFFICE/server · Note
• https://t.me/cvenotify/117384 · Telegram Post
• https://t.me/cvedetector/5134 · Telegram Post
• https://t.me/cvenotify/43187 · Telegram Post
• https://t.me/cvenotify/93988 · Telegram Post
• https://t.me/cvenotify/95452 · Telegram Post
• https://t.me/cvedetector/5139 · Telegram Post
• https://t.me/cvenotify/127558 · Telegram Post
• https://t.me/cvenotify/93989 · Telegram Post
• https://t.me/cvenotify/93949 · Telegram Post