CVE-2020-12432

The WOPI API integration for Vereign Collabora CODE through 4.2.2 does not properly restrict delivery of JavaScript to a victim's browser, and lacks proper MIME type access control, which could lead to XSS that steals account credentials via cookies or local storage. The attacker must first obtai...

PT-2020-13111

Name of the Vulnerable Software and Affected Versions Vereign Collabora CODE versions through 4.2.2 Description The issue concerns the WOPI API integration, which fails to properly restrict JavaScript delivery to a victim's browser and lacks proper MIME type access control. This could lead to...

CVE-2020-12432: Improper Neutralization of Input During Web Page Generation

The WOPI API integration for Vereign Collabora CODE through 4.2.2 does not properly restrict delivery of JavaScript to a victim's browser, and lacks proper MIME type access control, which could lead to XSS that steals account credentials via cookies or local storage. The attacker must first obtai...