CVE-2021-43446

2023-01-2300:00:00

mitre

www.cve.org

onlyoffice

cross site scripting

xss

macros feature

EPSS

0.001

Percentile

34.5%

JSON

ONLYOFFICE all versions as of 2021-11-08 is vulnerable to Cross Site Scripting (XSS). The “macros” feature of the document editor allows malicious cross site scripting payloads to be used.

References

github.com/ONLYOFFICE/server

labs.nettitude.com/blog/exploiting-onlyoffice-web-sockets-for-unauthenticated-remote-code-execution/

onlyoffice.com/

EPSS

0.001

Percentile

34.5%

JSON

Related for CVELIST:CVE-2021-43446