Vulnerability · Published Apr 4, 2024 · Assigned by GitHub_M
CVE-2024-29182Collabora Online Stored Cross-Site-Scripting vulnerability via tooltip
Medium 6.1
In plain English
A medium-severity cross-site scripting in online from CollaboraOnline. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 27% of all known vulnerabilities).
Official description
Collabora Online is a collaborative online office suite based on LibreOffice. A stored cross-site scripting vulnerability was found in Collabora Online. An attacker could create a document with an XSS payload in document text referenced by field which, if hovered over to produce a tooltip, could be executed by the user's browser. Users should upgrade to Collabora Online 23.05.10.1 or higher. Earlier series of Collabora Online, 22.04, 21.11, etc. are unaffected.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| CollaboraOnline | online | >= 23, < 23.05.10.1 |
Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N