CVE-2021-43448

ONLYOFFICE all versions as of 2021-11-08 is vulnerable to Improper Input Validation. A lack of input validation can allow an attacker to spoof the names of users who interact with a document, if the document id is known.

• CWE-20
• CWE-20

• https://github.com/ONLYOFFICE/serverThird Party Advisory
• https://labs.nettitude.com/blog/exploiting-onlyoffice-web-sockets-for-unauthenticated-remote-code-execution/Exploit, Mitigation, Third Party Advisory
• https://www.onlyoffice.com/Product, Vendor Advisory
• https://github.com/ONLYOFFICE/serverThird Party Advisory
• https://labs.nettitude.com/blog/exploiting-onlyoffice-web-sockets-for-unauthenticated-remote-code-execution/Exploit, Mitigation, Third Party Advisory
• https://www.onlyoffice.com/Product, Vendor Advisory

Published

Jan 23, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-43441An HTML Injection Vulnerability in iOrder 1.0 allows the rem…5.3
• CVE-2021-43442A Logic Flaw vulnerability exists in i3 International Inc An…8.1
• CVE-2021-43444ONLYOFFICE all versions as of 2021-11-08 is affected by Inco…7.5
• CVE-2021-43445ONLYOFFICE all versions as of 2021-11-08 is affected by Inco…9.8
• CVE-2021-43446ONLYOFFICE all versions as of 2021-11-08 is vulnerable to Cr…6.1
• CVE-2021-43447ONLYOFFICE all versions as of 2021-11-08 is affected by Inco…7.5
• CVE-2021-43449ONLYOFFICE all versions as of 2021-11-08 is vulnerable to Se…8.1
• CVE-2021-4345The uListing plugin for WordPress is vulnerable to authoriza…5.3
• CVE-2021-43451SQL Injection vulnerability exists in PHPGURUKUL Employee Re…9.8
• CVE-2021-43453A Heap-based Buffer Overflow vulnerability exists in JerrySc…9.8
• CVE-2021-43454An Unquoted Service Path vulnerability exists in AnyTXT Sear…7.8
• CVE-2021-43455An Unquoted Service Path vulnerability exists in FreeLAN 2.2…7.8