Onlyoffice Server vulnerabilities
6 known vulnerabilities affecting onlyoffice/server.
Total CVEs
6
CISA KEV
0
Public exploits
0
Exploited in wild
0
Severity breakdown
CRITICAL1HIGH3MEDIUM2
Vulnerabilities
Page 1 of 1
CVE-2021-43445P2CRITICALCVSS 9.8≤ 7.0.0.492023-01-23
CVE-2021-43445 [CRITICAL] CWE-287 CVE-2021-43445: ONLYOFFICE all versions as of 2021-11-08 is affected by Incorrect Access Control. An attacker can au
ONLYOFFICE all versions as of 2021-11-08 is affected by Incorrect Access Control. An attacker can authenticate with the web socket service of the ONLYOFFICE document editor which is protected by JWT auth by using a default JWT signing key.
nvd
CVE-2021-43447P3HIGHCVSS 7.5≤ 7.0.0.492023-01-23
CVE-2021-43447 [HIGH] CWE-306 CVE-2021-43447: ONLYOFFICE all versions as of 2021-11-08 is affected by Incorrect Access Control. An authentication
ONLYOFFICE all versions as of 2021-11-08 is affected by Incorrect Access Control. An authentication bypass in the document editor allows attackers to edit documents without authentication.
nvd
CVE-2021-43444P3HIGHCVSS 7.5≤ 7.0.0.492023-01-23
CVE-2021-43444 [HIGH] CWE-287 CVE-2021-43444: ONLYOFFICE all versions as of 2021-11-08 is affected by Incorrect Access Control. Signed document do
ONLYOFFICE all versions as of 2021-11-08 is affected by Incorrect Access Control. Signed document download URLs can be forged due to a weak default URL signing key.
nvd
CVE-2021-43449P3HIGHCVSS 8.1≤ 7.0.0.492023-01-23
CVE-2021-43449 [HIGH] CWE-918 CVE-2021-43449: ONLYOFFICE all versions as of 2021-11-08 is vulnerable to Server-Side Request Forgery (SSRF). The do
ONLYOFFICE all versions as of 2021-11-08 is vulnerable to Server-Side Request Forgery (SSRF). The document editor service can be abused to read and serve arbitrary URLs as a document.
nvd
CVE-2021-43448P4MEDIUMCVSS 5.3≤ 7.0.0.492023-01-23
CVE-2021-43448 [MEDIUM] CWE-20 CVE-2021-43448: ONLYOFFICE all versions as of 2021-11-08 is vulnerable to Improper Input Validation. A lack of input
ONLYOFFICE all versions as of 2021-11-08 is vulnerable to Improper Input Validation. A lack of input validation can allow an attacker to spoof the names of users who interact with a document, if the document id is known.
nvd
CVE-2021-43446P4MEDIUMCVSS 6.1≤ 7.0.0.492023-01-23
CVE-2021-43446 [MEDIUM] CWE-79 CVE-2021-43446: ONLYOFFICE all versions as of 2021-11-08 is vulnerable to Cross Site Scripting (XSS). The "macros" f
ONLYOFFICE all versions as of 2021-11-08 is vulnerable to Cross Site Scripting (XSS). The "macros" feature of the document editor allows malicious cross site scripting payloads to be used.
nvd