CVE-2023-34088

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2023-34088
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2023-34088.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2023-34088
Aliases
  • GHSA-7582-pwfh-3pwr
Published
2023-05-31T18:15:42.895Z
Modified
2025-11-29T14:17:31.208190Z
Severity
  • 8.7 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N CVSS Calculator
Summary
Collabora Online has Stored Cross-Site-Scripting vulnerability in admin interface
Details

Collabora Online is a collaborative online office suite. A stored cross-site scripting (XSS) vulnerability was found in Collabora Online prior to versions 22.05.13, 21.11.9.1, and 6.4.27. An attacker could create a document with an XSS payload as a document name. Later, if an administrator opened the admin console and navigated to the history page, the document name was injected as unescaped HTML and executed as a script inside the context of the admin console. The administrator JSON web token (JWT) used for the websocket connection could be leaked through this flaw. Users should upgrade to Collabora Online 22.05.13 or higher; Collabora Online 21.11.9.1 or higher; Collabora Online 6.4.27 or higher to receive a patch.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/34xxx/CVE-2023-34088.json",
    "cwe_ids": [
        "CWE-79"
    ]
}
References

Affected packages

Git / github.com/collaboraonline/online

Affected ranges

Type
GIT
Repo
https://github.com/collaboraonline/online
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
eca6768f38cc824294b4152a90dc457cc691dc8b

Affected versions

1.*

1.6.0-0
1.6.0-4-CODE
1.6.2-1

Other

co-4-2-0-branch-point
collabora-online-1-0-branch-point
collabora-online-1-9-branch-point
collabora-online-2-0-branch-point
collabora-online-2-1-branch-point
collabora-online-3-0-branch-point
collabora-online-4-branch-point
libreoffice-5-2-branch-point
libreoffice-5-3-branch-point
libreoffice-5-4-branch-point
libreoffice-6-0-branch-point
libreoffice-6-1-branch-point
libreoffice-6-2-branch-point
libreoffice-6-3-branch-point
libreoffice-6-4-branch-point
libreoffice-7-0-branch-point

cp-6.*

cp-6.4.0-1
cp-6.4.0-10
cp-6.4.0-11
cp-6.4.0-12
cp-6.4.0-13
cp-6.4.0-14
cp-6.4.0-15
cp-6.4.0-2
cp-6.4.0-3
cp-6.4.0-4
cp-6.4.0-6
cp-6.4.0-7
cp-6.4.0-8
cp-6.4.0-9
cp-6.4.1-1
cp-6.4.1-2
cp-6.4.1-3
cp-6.4.1-4
cp-6.4.10-1
cp-6.4.10-5
cp-6.4.10-6
cp-6.4.10-7
cp-6.4.10-8
cp-6.4.10-9
cp-6.4.11-1
cp-6.4.13-1
cp-6.4.14-1
cp-6.4.14-2
cp-6.4.14-3
cp-6.4.15-1
cp-6.4.16-1
cp-6.4.16-2
cp-6.4.17-1
cp-6.4.18-1
cp-6.4.19-1
cp-6.4.2-1
cp-6.4.20-1
cp-6.4.21-1
cp-6.4.22-1
cp-6.4.23-1
cp-6.4.24-1
cp-6.4.25-1
cp-6.4.25-2
cp-6.4.26-1
cp-6.4.3-1
cp-6.4.4-1
cp-6.4.4-2
cp-6.4.4-3
cp-6.4.5-1
cp-6.4.6-1
cp-6.4.6-2
cp-6.4.6-3
cp-6.4.6-4
cp-6.4.6-5
cp-6.4.6-6
cp-6.4.7-1
cp-6.4.7-2
cp-6.4.7-3
cp-6.4.7-4
cp-6.4.7-5
cp-6.4.8-1
cp-6.4.8-2