CVE-2021-43817: high-severity vulnerability in CollaboraOnline online
Reflected Cross-Site-Scripting vulnerability in Collabora Online
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 8.2epss 0.7%
Collabora Online is a collaborative online office suite based on LibreOffice technology. In affected versions a reflected XSS vulnerability was found in Collabora Online. An attacker could inject unescaped HTML into a variable as they created the Collabora Online iframe, and execute scripts inside the context of the Collabora Online iframe. This would give access to a small set of user settings stored in the browser, as well as the session's authentication token which was also passed in at iframe creation time. Users should upgrade to Collabora Online 6.4.16 or higher or Collabora Online 4.2.20 or higher. Collabora Online Development Edition 21.11 is not affected.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:N
Affected products
CollaboraOnline · onlineRelated CVEs — CollaboraOnline online
In the same product, most dangerous first.
CVE-2025-66208HIGHConfiguration-Dependent RCE (OS Command Injection) in richdocumentscode proxyEPSS 1.8%CVE-2021-32744CRITICALUnauthenticated attacker could gain access to currently open filesEPSS 1.1%CVE-2021-32745HIGHReflected Cross-Site-Scripting vulnerabilityEPSS 0.6%CVE-2025-24796MEDIUMRemote Code Execution within Collabora Online jail with Macros EnabledEPSS 0.5%CVE-2023-49788HIGHImproper handling of browser-side provided input in richdocuments path handlingEPSS 0.5%CVE-2025-27791HIGHCollabora Online Vulnerable to Arbitrary File WriteEPSS 0.5%