ONLYOFFICE Docs before 8.1.0 allows XSS via a GeneratorFunction Object attack against a macro. This is related to use of an immediately-invoked function expression (IIFE) for a macro. NOTE: this issue exists because of an incorrect fix for CVE-2021-43446 and CVE-2023-50883.
CVSS
No CVSS.
References
| Link | Resource |
|---|---|
| https://www.onlyoffice.com/ | Product |
| https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2023-027.txt | Exploit Third Party Advisory |
| https://www.syss.de/pentest-blog/cross-site-scripting-schwachstelle-in-onlyoffice-docs-syss-2023-027 | Third Party Advisory |
Configurations
History
03 Jul 2025, 12:20
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2023-027.txt - Exploit, Third Party Advisory | |
| References | () https://www.syss.de/pentest-blog/cross-site-scripting-schwachstelle-in-onlyoffice-docs-syss-2023-027 - Third Party Advisory | |
| References | () https://www.onlyoffice.com/ - Product | |
| CPE | cpe:2.3:a:onlyoffice:onlyoffice:*:*:*:*:document_server:*:*:* | |
| First Time |
Onlyoffice onlyoffice
Onlyoffice |
09 Sep 2024, 20:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-09-09 20:15
Updated : 2025-07-03 12:20
NVD link : CVE-2024-44085
Mitre link : CVE-2024-44085
JSON object : View
Products Affected
onlyoffice
- onlyoffice
CWE
No CWE.