Lucene search
HistoryJan 23, 2023 - 3:15 p.m.
CVE-2021-43446
onlyoffice
cross site scripting
document editor
xss
vulnerable
CVSS3
6.1
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
EPSS
0.001
Percentile
35.4%
ONLYOFFICE all versions as of 2021-11-08 is vulnerable to Cross Site Scripting (XSS). The “macros” feature of the document editor allows malicious cross site scripting payloads to be used.
Affected configurations
Node
onlyofficeserverRange≤7.0.0.49
Related
cve
cve
osv
osv
CVE-2021-43446
2023-01-23 15:15:13
prion
prion
Cross site scripting
2023-01-23 15:15:00
cvelist
cvelist
vulnrichment
vulnrichment
CVE-2023-50883
2024-09-09 00:00:00
CVE-2024-44085
2024-09-09 00:00:00
nvd
nvd
CVE-2023-50883
2024-09-09 20:15:03
CVE-2024-44085
2024-09-09 20:15:04
CVSS3
6.1
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
EPSS
0.001
Percentile
35.4%
Related for NVD:CVE-2021-43446