← Vulnerability feed

Vulnerability record · CVE-2024-45045 · published 29 August 2024

CVE-2024-45045: Collabora online cross-site scripting vulnerability

Collabora · Online

Collabora Online is a collaborative online office suite based on LibreOffice technology. In the mobile (Android/iOS) device variants of Collabora Online it was possible to inject JavaScript via url encoded values in links contained in documents. Since the Android JavaScript interface allows access to internal functions, the likelihood that the app could be compromised via this vulnerability is considered high. Non-mobile variants are not affected. Mobile variants should update to the latest version provided by the platform appstore. There are no known workarounds for this vulnerability.

6.1 CVSS 3.1 Medium EPSS 0.29% · top 80.8% CWE-84 · CWE-84CWE-79 · Cross-site scripting
6.1CVSS 3.1 base score
0.29%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
1References
17 Jun 2026Last modified by NVD

Description

Collabora Online is a collaborative online office suite based on LibreOffice technology. In the mobile (Android/iOS) device variants of Collabora Online it was possible to inject JavaScript via url encoded values in links contained in documents. Since the Android JavaScript interface allows access to internal functions, the likelihood that the app could be compromised via this vulnerability is considered high. Non-mobile variants are not affected. Mobile variants should update to the latest version provided by the platform appstore. There are no known workarounds for this vulnerability.

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/CollaboraOnline/online/security/advisories/GHSA-78cg-rg4q-26qv Vendor Advisory

Track CVE-2024-45045 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

7.5CVE-2021-32744Collabora online insecure direct object reference vulnerabilityCollabora Online is a collaborative online office suite. In versions prior to 4.2.17-1 and version 6.4.9-5, unauthenticated attackers are able to gai…EPSS 1.1%7.2CVE-2025-66208Collabora online os command injection vulnerabilityCollabora Online - Built-in CODE Server (richdocumentscode) provides a built-in server with all of the document editing features of Collabora Online.…EPSS 1.1%6.1CVE-2023-31145Collabora online cross-site scripting vulnerabilityCollabora Online is a collaborative online office suite based on LibreOffice technology. This vulnerability report describes a reflected XSS vulnerab…EPSS 0.40%6.1CVE-2021-43817Collabora online cross-site scripting vulnerabilityCollabora Online is a collaborative online office suite based on LibreOffice technology. In affected versions a reflected XSS vulnerability was found…EPSS 0.65%6.1CVE-2021-32745Collabora online cross-site scripting vulnerabilityCollabora Online is a collaborative online office suite. A reflected XSS vulnerability was found in Collabora Online prior to version 6.4.9-5. An att…EPSS 0.60%5.3CVE-2024-25114Collabora online information exposure vulnerabilityCollabora Online is a collaborative online office suite based on LibreOffice technology. Each document in Collabora Online is opened by a separate "K…EPSS 0.47%6.9CVE-2026-67279Mikrotik routeros vulnerabilityRouterOS SSH enters the connection protocol after a client-requested rekey even though user authentication was never attempted, allowing an unauthent…KEVEPSS 1.0%8.8CVE-2026-85046Google Chrome V8 type confusion enables sandboxed remote code executionChrome's V8 JavaScript engine contains a type confusion flaw (CWE-843) fixed in version 152.0.7977.82. A crafted HTML page can trigger the confusion …KEVEPSS 49%analysed

Source: NIST National Vulnerability Database (record CVE-2024-45045), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.