ONLYOFFICE

Records38All Threatist records

Exploited (KEV)1In CISA KEV

CVSS critical17CVSS 9.0–10.0

CVSS high7CVSS 7.0–8.9

Exploited now

ONLYOFFICE records in CISA KEV

Products in the NVD configurations · select one to filter the records

6 records in Server · all components

TI-2021-19374 CVE-2021-43447 · GHSA-v44r-r7pp-7r2w

HIGH 72

ONLYOFFICE all versions as of 2021-11-08 is affected by Incorrect Access Control.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01278 Published 2023-01-23 No fix listed CWE-306

TI-2021-19376 CVE-2021-43449 · GHSA-pw64-6v6v-94vp

HIGH 70

ONLYOFFICE all versions as of 2021-11-08 is vulnerable to Server-Side Request Forgery (SSRF).

CVSS 3.1HIGH 8.1 Network No auth User interaction EPSS 0.01273 Published 2023-01-23 No fix listed CWE-918

TI-2021-19373 CVE-2021-43446 · GHSA-5w4f-g47c-43mg

MEDIUM 60

ONLYOFFICE all versions as of 2021-11-08 is vulnerable to Cross Site Scripting (XSS).

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.0084 Published 2023-01-23 No fix listed CWE-79

TI-2021-19375 CVE-2021-43448 · GHSA-hq34-fgpx-qmf6

MEDIUM 57

ONLYOFFICE all versions as of 2021-11-08 is vulnerable to Improper Input Validation.

CVSS 3.1MEDIUM 5.3 Network No auth User interaction EPSS 0.01031 Published 2023-01-23 No fix listed CWE-20

TI-2021-19372 CVE-2021-43445 · GHSA-7wj3-gw7r-qr35

MEDIUM 52

ONLYOFFICE all versions as of 2021-11-08 is affected by Incorrect Access Control.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0174 Published 2023-01-23 No fix listed CWE-287

TI-2021-19371 CVE-2021-43444 · GHSA-6243-j7h8-mqf5

MEDIUM 41

ONLYOFFICE all versions as of 2021-11-08 is affected by Incorrect Access Control.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01223 Published 2023-01-23 No fix listed CWE-287