Collabora Online: Reflected HTML injection through host_session_id

Özet

Türkçe özeti henüz hazır değil; şimdilik kaynağın kendi açıklamasını gösteriyoruz.

Collabora Online is a collaborative online office suite based on LibreOffice technology. Prior to 24.04.18 and 25.04.11, the host_session_id query/form parameter is substituted into the cool.html editor page without HTML encoding, unlike parameters passed through the existing variable-encoding mechanism. An attacker who induces a victim to load a crafted URL can inject HTML and, in the absence of an effective Content Security Policy, execute scripts in the Collabora Online iframe's origin, exposing the session authentication token and page contents. A reverse proxy that preserves the Content Security Policy header sent by coolwsd mitigates the script-execution scenario. This issue is fixed in versions 24.04.18 and 25.04.11.

Etkilenen sürümler1 yazılım

Kaynaklar4 kaynak

• CVE.org kaydı
• NVD kaydı
• github.com/…online/security/advisories/GHSA-wgmm-q3ch-64jj Diğer
• github.com/…ommit/2d4469d27f0c52f4b28b64090e60452d2e147279 Diğer

Kayıt geçmişi

1. 30 Eki 2026 17:57Yayımlandı

İlgili açıklar

• 4,3 CVE-2026-46499Collabora Online: Read-only session authorization bypass permits live document edits
• 8,1 CVE-2026-61804myTinyWMS has Stored Cross-Site Scripting (XSS) in Product and Category Management
• 5,1 CVE-2026-39375Frappe LMS has Stored XSS in Course Meta
• 6,5 CVE-2026-119365WordPress Media Player Addons for Elementor – Media Player widget for WP plugin <= 1.1.10 - Cross Site Scripting (XSS) vulnerability
• 5,3 CVE-2026-105454Stored XSS via crafted URLs in HTML ticket content in Request Tracker
• 5,3 CVE-2026-105455Stored XSS via related ticket subject on RTIR Split and Create Incident forms