CVE-2021-32744: falha crítica em CollaboraOnline online
Unauthenticated attacker could gain access to currently open files
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
28Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 9.8epss 1.1%
Collabora Online is a collaborative online office suite. In versions prior to 4.2.17-1 and version 6.4.9-5, unauthenticated attackers are able to gain access to files which are currently opened by other users in the Collabora Online editor. For successful exploitation the attacker is required to guess the file identifier - the predictability of this file identifier is dependent on external file-storage implementations (this is a potential "IDOR" - Insecure Direct Object Reference - vulnerability). Versions 4.2.17-1 and 6.4.9-5 contain patches for this issue. There is no known workaround except updating the Collabora Online application to one of the patched releases.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
CollaboraOnline · onlineCVEs relacionadas — CollaboraOnline online
No mesmo produto, das mais perigosas para as menos.
CVE-2025-66208HIGHConfiguration-Dependent RCE (OS Command Injection) in richdocumentscode proxyEPSS 1.8%CVE-2021-43817HIGHReflected Cross-Site-Scripting vulnerability in Collabora OnlineEPSS 0.7%CVE-2021-32745HIGHReflected Cross-Site-Scripting vulnerabilityEPSS 0.6%CVE-2025-24796MEDIUMRemote Code Execution within Collabora Online jail with Macros EnabledEPSS 0.5%CVE-2023-49788HIGHImproper handling of browser-side provided input in richdocuments path handlingEPSS 0.5%CVE-2025-27791HIGHCollabora Online Vulnerable to Arbitrary File WriteEPSS 0.5%