Medium · 5.3 CVE-2021-43448 EUVD-2021-30381GHSA-hq34-fgpx-qmf6

ONLYOFFICE all versions as of 2021-11-08 is vulnerable to Improper Input Validation. A lack of input validation can allow an attacker to sp…

Published Jan 23, 2023 · Updated Apr 2, 2025 · Assigned by mitre

Description

ONLYOFFICE all versions as of 2021-11-08 is vulnerable to Improper Input Validation. A lack of input validation can allow an attacker to spoof the names of users who interact with a document, if the document id is known.

References

https://github.com/ONLYOFFICE/server
https://www.onlyoffice.com/
https://labs.nettitude.com/blog/exploiting-onlyoffice-web-sockets-for-unauthenticated-remote-code-execution/