Read the docs
TI-2021-19623 Aliases CVE-2021-43817

Reflected Cross-Site-Scripting vulnerability in Collabora Online

Priority LOW 37CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

Collabora Online is a collaborative online office suite based on LibreOffice technology. In affected versions a reflected XSS vulnerability was found in Collabora Online. An attacker could inject unescaped HTML into a variable as they created the Collabora Online iframe, and execute scripts inside the context of the Collabora Online iframe. This would give access to a small set of user settings stored in the browser, as well as the session's authentication token which was also passed in at iframe creation time. Users should upgrade to Collabora Online 6.4.16 or higher or Collabora Online 4.2.20 or higher. Collabora Online Development Edition 21.11 is not affected.

Why it matters now

EPSS 0.00667 52nd percentileScored 2026-11-07
Fix Fixed online (CollaboraOnline): 6.4.16, 4.2.20

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
Collaboraonline6.0.0 to before 6.4.16; before 4.2.206.4.16, 4.2.20Patch availableCNA
  • online VendorCollabora Affected 6.0.0 to before 6.4.16; before 4.2.20 Fixed in 6.4.16, 4.2.20 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:collabora:online:*:*:*:*:*:*:*:*before 4.2.20; 6.4.0 to before 6.4.16VulnerableCollabora
  • cpe:2.3:a:collabora:online:*:*:*:*:*:*:*:* Versions before 4.2.20; 6.4.0 to before 6.4.16 Vulnerable ·Collabora

Remediation

  • Fix · CNA online (CollaboraOnline) Fixed in 6.4.16, 4.2.20

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-43817
  2. 2026-10-06 EPSS moved to the 50th–90th percentile

References

Advisory 1

  • TI-2021-12412 Unauthenticated attacker could gain access to currently open files CVSS 3.1CRITICAL 9.8
  • TI-2021-12413 Reflected cross-site-scripting in Collabora online CVSS 3.1HIGH 7.3
  • TI-2024-30157 JavaScript Injection via url encoded values in links in Collabora Office Android CVSS 3.1MEDIUM 6.3
  • TI-2023-14855 Reflected XSS vulnerability in CollaboraOnline CVSS 3.1MEDIUM 6.1
  • TI-2024-16568 Sensitive Information Disclosure (JailID) to users in Collabora Online CVSS 3.1MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences