Medium · 5.4 CVE-2022-47412 EUVD-2022-50175GHSA-2chf-w4v5-vmmg

ONLYOFFICE Workspace Search Stored XSS

Published Feb 7, 2023 · Updated Mar 25, 2025 · Assigned by rapid7

Description

Given a malicious document provided by an attacker, the ONLYOFFICE Workspace DMS is vulnerable to a stored (persistent, or "Type II") cross-site scripting (XSS) condition.

Affected products

Vendor	Product	Affected	Fixed
ONLYOFFICE	Workspace	≤ 12.1.0.1760	—

References

https://www.rapid7.com/blog/post/2023/02/07/multiple-dms-xss-cve-2022-47412-through-cve-20222-47419/ third-party-advisory
https://github.com/ONLYOFFICE/DocumentServer/blob/master/CHANGELOG.md#733 release-notes