CVE-2021-32744: Unauthenticated attacker could gain access to currently open files
Collabora Online is a collaborative online office suite. In versions prior to 4.2.17-1 and version 6.4.9-5, unauthenticated attackers are able to gain access to files which are currently opened by other users in the Collabora Online editor. For successful exploitation the attacker is required to guess the file identifier - the predictability of this file identifier is dependent on external file-storage implementations (this is a potential "IDOR" - Insecure Direct Object Reference - vulnerability). Versions 4.2.17-1 and 6.4.9-5 contain patches for this issue. There is no known workaround except updating the Collabora Online application to one of the patched releases.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2021-32744?
CVE-2021-32744 is considered a critical vulnerability due to the potential unauthorized access to files by unauthenticated attackers.
How do I fix CVE-2021-32744?
To fix CVE-2021-32744, update Collabora Online to version 4.2.17-1 or later, or 6.4.9-5 or later.
What are the affected versions for CVE-2021-32744?
CVE-2021-32744 affects Collabora Online versions prior to 4.2.17-1 and versions between 6.4.0 and 6.4.9-5.
Can CVE-2021-32744 be exploited remotely?
Yes, CVE-2021-32744 can be exploited remotely by unauthenticated attackers.
What are the consequences of CVE-2021-32744 exploitation?
Exploitation of CVE-2021-32744 allows attackers to gain access to files currently opened by other users, potentially compromising sensitive information.