CVE-2022-47412 ONLYOFFICE Workspace Search Stored XSS

2023-02-0719:16:17

CWE-79

rapid7

www.cve.org

onlyoffice workspace

xss

vulnerability

stored

0.001 Low

EPSS

Percentile

23.4%

JSON

Given a malicious document provided by an attacker, the ONLYOFFICE Workspace DMS is vulnerable to a stored (persistent, or “Type II”) cross-site scripting (XSS) condition.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Workspace",
    "vendor": "ONLYOFFICE",
    "versions": [
      {
        "lessThanOrEqual": "12.1.0.1760",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  }
]