High · 7.5 CVE-2021-43447 EUVD-2021-30380GHSA-v44r-r7pp-7r2w

ONLYOFFICE all versions as of 2021-11-08 is affected by Incorrect Access Control. An authentication bypass in the document editor allows at…

Published Jan 23, 2023 · Updated Apr 2, 2025 · Assigned by mitre

Description

ONLYOFFICE all versions as of 2021-11-08 is affected by Incorrect Access Control. An authentication bypass in the document editor allows attackers to edit documents without authentication.

References

https://github.com/ONLYOFFICE/server
https://www.onlyoffice.com/
https://labs.nettitude.com/blog/exploiting-onlyoffice-web-sockets-for-unauthenticated-remote-code-execution/