CVE-2024-45045

Collabora Online is a collaborative online office suite based on LibreOffice technology. In the mobile (Android/iOS) device variants of Collabora Online it was possible to inject JavaScript via url encoded values in links contained in documents. Since the Android JavaScript interface allows access to internal functions, the likelihood that the app could be compromised via this vulnerability is considered high. Non-mobile variants are not affected. Mobile variants should update to the latest version provided by the platform appstore. There are no known workarounds for this vulnerability.

• CWE-84
• CWE-79

• https://github.com/CollaboraOnline/online/security/advisories/GHSA-78cg-rg4q-26qvVendor Advisory

Published

Aug 29, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-4504A vulnerability, which was classified as critical, has been …7.2
• CVE-2024-45040gnark is a fast zk-SNARK library that offers a high-level AP…5.9
• CVE-2024-45041External Secrets Operator is a Kubernetes operator that inte…8.8
• CVE-2024-45042Ory Kratos is an identity, user management and authenticatio…4.4
• CVE-2024-45043The OpenTelemetry Collector module AWS firehose receiver is …5.3
• CVE-2024-45044Bareos is open source software for backup, archiving, and re…8.8
• CVE-2024-45046PHPSpreadsheet is a pure PHP library for reading and writing…5.4
• CVE-2024-45047svelte performance oriented web framework. A potential mXSS …6.1
• CVE-2024-45048PHPSpreadsheet is a pure PHP library for reading and writing…6.5
• CVE-2024-45049Hydra is a Continuous Integration service for Nix based proj…7.5
• CVE-2024-4505A vulnerability, which was classified as critical, was found…7.2
• CVE-2024-45050Ringer server is the server code for the Ringer messaging ap…7.1