Collabora online vulnerabilities

Latest Collabora online CVEs

Newest publication first

1. CVE-2024-45045 JavaScript Injection via url encoded values in links in Collabora Office Android

   Published 2024-08-29

   Medium·CVSS 6.1 EPSS 0.29%

   Collabora Online is a collaborative online office suite based on LibreOffice technology. In the mobile (Android/iOS) device variants of Collabora Online it was possible to inject JavaScript via url encoded values in links contained in documents. Since the Android JavaScript inter...

2. CVE-2024-25114 Sensitive Information Disclosure (JailID) to users in Collabora Online

   Published 2024-03-11

   Medium·CVSS 5.3 EPSS 0.47%

   Collabora Online is a collaborative online office suite based on LibreOffice technology. Each document in Collabora Online is opened by a separate "Kit" instance in a different "jail" with a unique directory "jailID" name. For security reasons, this directory name is randomly gen...

3. CVE-2023-31145 Reflected XSS vulnerability in CollaboraOnline

   Published 2023-05-15

   Medium·CVSS 6.1 EPSS 0.40%

   Collabora Online is a collaborative online office suite based on LibreOffice technology. This vulnerability report describes a reflected XSS vulnerability with full CSP bypass in Nextcloud installations using the recommended bundle. The vulnerability can be exploited to perform a...

4. CVE-2021-43817 Reflected Cross-Site-Scripting vulnerability in Collabora Online

   Published 2021-12-13

   Medium·CVSS 6.1 EPSS 0.67%

   Collabora Online is a collaborative online office suite based on LibreOffice technology. In affected versions a reflected XSS vulnerability was found in Collabora Online. An attacker could inject unescaped HTML into a variable as they created the Collabora Online iframe, and exec...

5. CVE-2021-32745 Reflected Cross-Site-Scripting vulnerability

   Published 2021-07-21

   Medium·CVSS 6.1 EPSS 0.60%

   Collabora Online is a collaborative online office suite. A reflected XSS vulnerability was found in Collabora Online prior to version 6.4.9-5. An attacker could inject unescaped HTML into a variable as they created the Collabora Online iframe, and execute scripts inside the conte...

6. CVE-2021-32744 Unauthenticated attacker could gain access to currently open files

   Published 2021-07-21

   High·CVSS 7.5 EPSS 1.1%

   Collabora Online is a collaborative online office suite. In versions prior to 4.2.17-1 and version 6.4.9-5, unauthenticated attackers are able to gain access to files which are currently opened by other users in the Collabora Online editor. For successful exploitation the attacke...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.