CVE-2023-31145

CVE-2023-31145 describes a reflected XSS with full CSP bypass in Collabora Online when installed with the Nextcloud bundle. The vulnerability allows an attacker to inject malicious code into pages and run in the victim’s browser session, enabling a trivial account takeover attack. Exploitation re...