Medium severity · published Jul 21, 2021
CVE-2021-32745
Collabora Online is a collaborative online office suite
6.1
CVSS
0.6%
EPSS
No
On KEV
Description
Collabora Online is a collaborative online office suite. A reflected XSS vulnerability was found in Collabora Online prior to version 6.4.9-5. An attacker could inject unescaped HTML into a variable as they created the Collabora Online iframe, and execute scripts inside the context of the Collabora Online iframe. This would give access to a small set of user settings stored in the browser, as well as the session's authentication token which was also passed in at iframe creation time. The issue is patched in Collabora Online 6.4.9-5. Collabora Online 4.2 is not affected.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 49% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ON
Online · Collabora
after 4.2 before 6.4.9-5 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-32745
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-32745
Third Party Advisory
https://github.com/CollaboraOnline/online/security/advisories/GHSA-w536-654v-cjj9
More from Online
9.8
CVE-2026-110447
Collabora Online – Built-in CODE Server OS Command Injection Vulnerability
9.8
CVE-2025-66208
Collabora Online - Built-in CODE Server (richdocumentscode) provides a built-in server with all of the document editing features of Collabora Online
7.5
CVE-2021-32744
Collabora Online is a collaborative online office suite
6.1
CVE-2024-45045
Collabora Online is a collaborative online office suite based on LibreOffice technology
6.1
CVE-2023-31145
Collabora Online is a collaborative online office suite based on LibreOffice technology