CVE-2024-44085

ONLYOFFICE Docs before 8.1.0 allows XSS via a GeneratorFunction Object attack against a macro. This is related to use of an immediately-invoked function expression IIFE for a macro. NOTE: this issue exists because of an incorrect fix for CVE-2021-43446 and CVE-2023-50883...

CVE-2021-43446

ONLYOFFICE Docs prior to 8.1.0 are affected by XSS involving macros. The vulnerability stems from macros defined as Immediately-Invoked Function Expressions (IIFEs), enabling sandbox escape by calling the Function constructor. Related CVEs (CVE-2021-43446 and CVE-2023-50883) describe the same mac...

CVE-2021-43446

ONLYOFFICE all versions as of 2021-11-08 is vulnerable to Cross Site Scripting XSS. The "macros" feature of the document editor allows malicious cross site scripting payloads to be used...