CVE-2024-44085: XSS
ONLYOFFICE Docs before 8.1.0 allows XSS via a GeneratorFunction Object attack against a macro. This is related to use of an immediately-invoked function expression (IIFE) for a macro. NOTE: this issue exists because of an incorrect fix for CVE-2021-43446 and CVE-2023-50883.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-44085?
CVE-2024-44085 is classified as a high severity vulnerability due to its potential to allow cross-site scripting (XSS) attacks.
How do I fix CVE-2024-44085?
To fix CVE-2024-44085, upgrade ONLYOFFICE Docs to version 8.1.0 or later.
What is CVE-2024-44085?
CVE-2024-44085 is a vulnerability in ONLYOFFICE Docs that allows XSS via a GeneratorFunction Object attack against macros.
Which versions of ONLYOFFICE Docs are affected by CVE-2024-44085?
ONLYOFFICE Docs versions prior to 8.1.0 are affected by CVE-2024-44085.
What type of attack is possible with CVE-2024-44085?
CVE-2024-44085 allows for a cross-site scripting (XSS) attack through the exploitation of macros using an immediately-invoked function expression.