High · 7.5 CVE-2021-43444 EUVD-2021-30377GHSA-6243-j7h8-mqf5

ONLYOFFICE all versions as of 2021-11-08 is affected by Incorrect Access Control. Signed document download URLs can be forged due to a weak…

Published Jan 23, 2023 · Updated Apr 2, 2025 · Assigned by mitre

Description

ONLYOFFICE all versions as of 2021-11-08 is affected by Incorrect Access Control. Signed document download URLs can be forged due to a weak default URL signing key.

References

https://github.com/ONLYOFFICE/server
https://www.onlyoffice.com/
https://labs.nettitude.com/blog/exploiting-onlyoffice-web-sockets-for-unauthenticated-remote-code-execution/