CVE-2023-34088: Collabora Online has Stored Cross-Site-Scripting vulnerability in admin interface
First published: Wed May 31 2023(Updated: )
Collabora Online is a collaborative online office suite. A stored cross-site scripting (XSS) vulnerability was found in Collabora Online prior to versions 22.05.13, 21.11.9.1, and 6.4.27. An attacker could create a document with an XSS payload as a document name. Later, if an administrator opened the admin console and navigated to the history page, the document name was injected as unescaped HTML and executed as a script inside the context of the admin console. The administrator JSON web token (JWT) used for the websocket connection could be leaked through this flaw. Users should upgrade to Collabora Online 22.05.13 or higher; Collabora Online 21.11.9.1 or higher; Collabora Online 6.4.27 or higher to receive a patch.
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Collabora Office Online | <6.4.27 | |
| Collabora Office Online | >=21.0<21.11.9.1 | |
| Collabora Office Online | >=22.0<22.05.13 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is CVE-2023-34088?
CVE-2023-34088 is a stored cross-site scripting (XSS) vulnerability found in Collabora Online prior to versions 22.05.13, 21.11.9.1, and 6.4.27.
What is the severity of CVE-2023-34088?
The severity of CVE-2023-34088 is high with a CVSS score of 5.4.
How does CVE-2023-34088 affect Collabora Online?
CVE-2023-34088 allows an attacker to create a document with an XSS payload as a document name, which can be executed when opened by an administrator.
Which versions of Collabora Online are affected by CVE-2023-34088?
CVE-2023-34088 affects Collabora Online versions prior to 22.05.13, 21.11.9.1, and 6.4.27.
How can I fix CVE-2023-34088?
To fix CVE-2023-34088, it is recommended to update Collabora Online to versions 22.05.13, 21.11.9.1, or 6.4.27.
- collector/nvd-latest
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/title
- agent/last-modified-date
- agent/references
- agent/severity
- agent/weakness
- agent/author
- agent/first-publish-date
- agent/description
- agent/event
- agent/source
- agent/softwarecombine
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/collaboraoffice
- canonical/collabora office online
- version/collabora office online/21.0
- version/collabora office online/22.0