CVE-2023-34088

Collabora Online is a collaborative online office suite. A stored cross-site scripting (XSS) vulnerability was found in Collabora Online prior to versions 22.05.13, 21.11.9.1, and 6.4.27. An attacker could create a document with an XSS payload as a document name. Later, if an administrator opened the admin console and navigated to the history page, the document name was injected as unescaped HTML and executed as a script inside the context of the admin console. The administrator JSON web token (JWT) used for the websocket connection could be leaked through this flaw. Users should upgrade to Collabora Online 22.05.13 or higher; Collabora Online 21.11.9.1 or higher; Collabora Online 6.4.27 or higher to receive a patch.

• CWE-79
• CWE-79

• https://github.com/CollaboraOnline/online/security/advisories/GHSA-7582-pwfh-3pwrThird Party Advisory
• https://github.com/CollaboraOnline/online/security/advisories/GHSA-7582-pwfh-3pwrThird Party Advisory

Published

May 31, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-34064Workspace ONE Launcher contains a Privilege Escalation Vulne…4.6
• CVE-2023-3407The Subscribe2 plugin for WordPress is vulnerable to Cross-S…4.3
• CVE-2023-3408The Bricks theme for WordPress is vulnerable to Cross-Site R…4.3
• CVE-2023-34085When an AWS DynamoDB table is used for user attribute storag…4.3
• CVE-2023-34086Improper input validation in some Intel(R) NUC BIOS firmware…6.7
• CVE-2023-34087An improper array index validation vulnerability exists in t…7.8
• CVE-2023-34089Decidim is a participatory democracy framework, written in R…6.1
• CVE-2023-3409The Bricks theme for WordPress is vulnerable to Cross-Site R…4.3
• CVE-2023-34090Decidim is a participatory democracy framework, written in R…7.5
• CVE-2023-34091Kyverno is a policy engine designed for Kubernetes. In versi…6.5
• CVE-2023-34092Vite provides frontend tooling. Prior to versions 2.9.16, 3.…7.5
• CVE-2023-34093Strapi is an open-source headless content management system.…7.1