CVE-2021-43817: Reflected Cross-Site-Scripting vulnerability in Collabora Online
Collabora Online is a collaborative online office suite based on LibreOffice technology. In affected versions a reflected XSS vulnerability was found in Collabora Online. An attacker could inject unescaped HTML into a variable as they created the Collabora Online iframe, and execute scripts inside the context of the Collabora Online iframe. This would give access to a small set of user settings stored in the browser, as well as the session's authentication token which was also passed in at iframe creation time. Users should upgrade to Collabora Online 6.4.16 or higher or Collabora Online 4.2.20 or higher. Collabora Online Development Edition 21.11 is not affected.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2021-43817?
CVE-2021-43817 has been rated as a moderate severity vulnerability due to its reflected XSS nature.
How do I fix CVE-2021-43817?
To remediate CVE-2021-43817, upgrade Collabora Online to a version beyond 6.4.16 or beyond 4.2.20.
What types of attacks are possible with CVE-2021-43817?
CVE-2021-43817 allows attackers to leverage reflected XSS to inject unescaped HTML into Collabora Online iframes.
Which versions of Collabora Online are affected by CVE-2021-43817?
CVE-2021-43817 affects Collabora Online versions prior to 4.2.20 and between 6.4.0 and 6.4.16 inclusive.
Who is at risk from CVE-2021-43817?
Users of affected versions of Collabora Online are at risk of XSS attacks due to this vulnerability.