XSS in Collabora Online
CVE-2024-45045
Collabora Online is a collaborative online office suite based on LibreOffice technology. In the mobile (Android/iOS) device variants of Collabora Online it was possible to inject JavaScript via url encoded values in links contained in documents. Since the Android JavaScript interface allows access to internal functions, the likelihood that the app could be compromised via this vulnerability is considered high. Non-mobile variants are not affected. Mobile variants should update to the latest version provided by the platform appstore. There are no known workarounds for this vulnerability.
EPSS: 0.003 (21.0th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 6.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L.
Affected products
- Collabora Online
- Collaboraonline Online — versions Collabora Office (Android): < 24.04.6.2
- Google Android
Weakness classification (CWE)
Public proof-of-concept exploits
References
- security-advisories@github.com (x_refsource_CONFIRM, Vendor Advisory)
Frequently asked questions
- What is CVE-2024-45045?
- CVE-2024-45045 is a medium-severity vulnerability in Collabora Online, classified under CWE-84. CVSS score: 6.3/10. Published 2024-08-29.
- How severe is CVE-2024-45045?
- Medium severity. CVSS v3 base score is 6.3 out of 10.
- Is CVE-2024-45045 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.