PT-2024-31396 · Collabora · Collabora Online

Tehofu · Published 2024-08-29 · Updated 2024-09-03 · CVE-2024-45045

Positive Technologies (AI Summary)

CVSS v3.1

6.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Collabora Online versions for mobile devices (Android/iOS)

Description Collabora Online is a collaborative online office suite based on LibreOffice technology. In the mobile device variants, it was possible to inject JavaScript via URL encoded values in links contained in documents. Since the Android JavaScript interface allows access to internal functions, the likelihood that the app could be compromised is considered high. Non-mobile variants are not affected.

Recommendations For mobile variants, update to the latest version provided by the platform app store. As a temporary workaround, consider restricting access to links contained in documents until a patch is available. Avoid using URL encoded values in links contained in documents until the issue is resolved. At the moment, there is no information about additional mitigation measures.

Exploit

Fix

XSS

Weakness Enumeration

CWE-84

CWE-79

Related Identifiers

CVE-2024-45045

GHSA-78CG-RG4Q-26QV

Affected Products

Collabora Online

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/45xxx/CVE-2024-45045.json · Exploit
• https://github.com/CollaboraOnline/online/security/advisories/GHSA-78cg-rg4q-26qv · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-45045 · Security Note
• https://osv.dev/vulnerability/CVE-2024-45045 · Vendor Advisory
• https://twitter.com/CVEnew/status/1829205873618760003 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1829227737304691076 · Twitter Post
• https://t.me/cvedetector/4431 · Telegram Post
• https://t.me/cvenotify/93065 · Telegram Post