CVE-2021-32745

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

Collabora Online is a collaborative online office suite. A reflected XSS vulnerability was found in Collabora Online prior to version 6.4.9-5. An attacker could inject unescaped HTML into a variable as they created the Collabora Online iframe, and execute scripts inside the context of the Collabora Online iframe. This would give access to a small set of user settings stored in the browser, as well as the session's authentication token which was also passed in at iframe creation time. The issue is patched in Collabora Online 6.4.9-5. Collabora Online 4.2 is not affected.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Jul 21, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-327465.3Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. Between versions 2.3.0 and 2.8.2, the `doc` mCVE-2021-327476.5Icinga Web 2 is an open source monitoring web interface, framework, and command-line interface. A vulnerability in which custom variables arCVE-2021-327484.3Nextcloud Richdocuments in an open source self hosted online office. Nextcloud uses the WOPI ("Web Application Open Platform Interface") proCVE-2021-327498.1fail2ban is a daemon to ban hosts that cause multiple authentication errors. In versions 0.9.7 and prior, 0.10.0 through 0.10.6, and 0.11.0 CVE-2021-32756.1Unauthenticated stored cross-site scripting (XSS) exists in multiple TP-Link products including WIFI Routers (Wireless AC routers), Access PCVE-2021-327505.7MuWire is a file publishing and networking tool that protects the identity of its users by using I2P technology. Users of MuWire desktop cliCVE-2021-327517.5Gradle is a build tool with a focus on build automation. In versions prior to 7.2, start scripts generated by the `application` plugin and tCVE-2021-327524.9Ether Logs is a package that allows one to check one's logs in the Craft 3 utilities section. A vulnerability was found in versions prior toCVE-2021-327536.5EdgeX Foundry is an open source project for building a common open framework for internet-of-things edge computing. A vulnerability exists iCVE-2021-327545.3FlowDroid is a data flow analysis tool. FlowDroid versions prior to 2.9.0 contained an XML external entity (XXE) vulnerability that allowed CVE-2021-327554.3Wire is a collaboration platform. wire-ios-transport handles authentication of requests, network failures, and retries for the iOS implementCVE-2021-327568.8ManageIQ is an open-source management platform. In versions prior to jansa-4, kasparov-2, and lasker-1, there is a flaw in the MiqExpression