CVE-2021-43447

概要

参考情報

• ONLYOFFICE/server · Third Party Advisory
• labs.nettitude.com/blog/exploiting-onlyoffice-web-sockets-for-unauthenticated-remote-code-execution · Exploit
• onlyoffice.com · Product

server のその他の脆弱性

• CVE-2021-43449高 8.1ONLYOFFICE all versions as of 2021-11-08 is vulnerable to Server-Side Request Forgery (SSRF). The document editor service can be abused to r…
• CVE-2021-43448中 5.3ONLYOFFICE all versions as of 2021-11-08 is vulnerable to Improper Input Validation. A lack of input validation can allow an attacker to spo…
• CVE-2021-43446中 6.1ONLYOFFICE all versions as of 2021-11-08 is vulnerable to Cross Site Scripting (XSS). The "macros" feature of the document editor allows mal…
• CVE-2021-43445緊急 9.8ONLYOFFICE all versions as of 2021-11-08 is affected by Incorrect Access Control. An attacker can authenticate with the web socket service o…
• CVE-2021-43444高 7.5ONLYOFFICE all versions as of 2021-11-08 is affected by Incorrect Access Control. Signed document download URLs can be forged due to a weak …