CVE-2021-43449

Description

References

• ONLYOFFICE/server · Third Party Advisory
• labs.nettitude.com/blog/exploiting-onlyoffice-web-sockets-for-unauthenticated-remote-code-execution · Exploit
• onlyoffice.com · Product

server의 다른 취약점

• CVE-2021-43448보통 5.3ONLYOFFICE all versions as of 2021-11-08 is vulnerable to Improper Input Validation. A lack of input validation can allow an attacker to spo…
• CVE-2021-43447높음 7.5ONLYOFFICE all versions as of 2021-11-08 is affected by Incorrect Access Control. An authentication bypass in the document editor allows att…
• CVE-2021-43446보통 6.1ONLYOFFICE all versions as of 2021-11-08 is vulnerable to Cross Site Scripting (XSS). The "macros" feature of the document editor allows mal…
• CVE-2021-43445심각 9.8ONLYOFFICE all versions as of 2021-11-08 is affected by Incorrect Access Control. An attacker can authenticate with the web socket service o…
• CVE-2021-43444높음 7.5ONLYOFFICE all versions as of 2021-11-08 is affected by Incorrect Access Control. Signed document download URLs can be forged due to a weak …