Published on: Not Yet Published
Last Modified on: 01/23/2023 05:17:00 PM UTC
The following vulnerability was found:
ONLYOFFICE all versions as of 2021-11-08 is affected by Incorrect Access Control. An attacker can authenticate with the web socket service of the ONLYOFFICE document editor which is protected by JWT auth by using a default JWT signing key.
- CVE-2021-43445 has been assigned by [email protected] to track the vulnerability
|ONLYOFFICE - Online Office for business | ONLYOFFICE|| www.onlyoffice.com |
|Remote Code Execution in ONLYOFFICE - Nettitude Labs|| labs.nettitude.com |
|GitHub - ONLYOFFICE/server: The backend server software layer which is the part of ONLYOFFICE Document Server and is the base for all other components|| github.com |