CVE-2020-12432

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

The WOPI API integration for Vereign Collabora CODE through 4.2.2 does not properly restrict delivery of JavaScript to a victim's browser, and lacks proper MIME type access control, which could lead to XSS that steals account credentials via cookies or local storage. The attacker must first obtain an API access token, which can be accomplished if the attacker is able to upload a .docx or .odt file. The associated API endpoints for exploitation are /wopi/files and /wopi/getAccessToken.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Jul 21, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-124385.4An XSS vulnerability exists in the banners.php page of PHP-Fusion 9.03.50. This can be exploited because the only security measure used agai CVE-2020-124395.3Grin before 3.1.0 allows attackers to adversely affect availability of data on a Mimblewimble blockchain.CVE-2020-12447.1A denial of service vulnerability exists when Connected User Experiences and Telemetry Service improperly handles file operations, aka 'Conn CVE-2020-124419.8Denial-of-Service (DoS) in Ivanti Service Manager HEAT Remote Control 7.4 due to a buffer overflow in the protocol parser of the ‘HEATRemote CVE-2020-124429.8Ivanti Avalanche 6.3 allows a SQL injection that is vaguely associated with the Apache HTTP Server, aka Bug 683250.CVE-2020-124439.8BigBlueButton before 2.2.6 allows remote attackers to read arbitrary files because the presfilename (lowercase) value can be a .pdf filename CVE-2020-124467.8The ene.sys driver in G.SKILL Trident Z Lighting Control through 1.00.08 exposes mapping and un-mapping of physical memory, reading and writ CVE-2020-124477.5A Local File Inclusion (LFI) issue on Onkyo TX-NR585 1000-0000-000-0008-0000 devices allows remote unauthenticated users on the network to r CVE-2020-124485.3GitLab EE 12.8 and later allows Exposure of Sensitive Information to an Unauthorized Actor via NuGet.CVE-2020-12457.0<p>An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory. An attack CVE-2020-124568.8A remote code execution vulnerability in Mitel MiVoice Connect Client before 214.100.1223.0 could allow an attacker to execute arbitrary cod CVE-2020-124577.5An issue was discovered in wolfSSL before 4.5.0. It mishandles the change_cipher_spec (CCS) message processing logic for TLS 1.3. If an atta