Security

Report a vulnerability

SECURITY.md

Security Policy

Supported Versions

Currently the following Collabora Online versions are supported with security updates.

Version	Supported
24.04.x	✅
23.05.x	✅
22.05.x	✅
21.11.x or older	❌

Reporting a Vulnerability

If you find a security vulnerability in Collabora Online please send an email to [email protected].

CVE-2024-5261 TLS certificates are not properly verified when utilizing LibreOfficeKit
GHSA-crg3-fjm2-xvpq published Jul 3, 2024 by caolanm

Low
CVE-2024-37311 Remote host TLS certificates are not fully verified
GHSA-hvhm-5c44-977x published Aug 23, 2024 by caolanm

High
CVE-2024-29182 Stored Cross-Site-Scripting vulnerability via tooltip
GHSA-9gmw-5q2c-4398 published Apr 2, 2024 by caolanm

High
CVE-2024-45045 JavaScript Injection via url encoded values in links
GHSA-78cg-rg4q-26qv published Aug 29, 2024 by caolanm

Moderate
CVE-2024-25114 Sensitive Information Disclosure (JailID) to users
GHSA-2fh2-ppjf-p3xv published Mar 11, 2024 by caolanm

Low
CVE-2023-49788 Improper handling of browser-side provided input in richdocuments path handling
GHSA-3r69-xvf7-v94j published Dec 8, 2023 by caolanm

High
CVE-2023-49782 Cross-Site-Scripting vulnerability in richdocuments error message handling
GHSA-8xm5-pgfr-8mjr published Dec 8, 2023 by caolanm

High
CVE-2023-48314 Unescaped passing of the request URL
GHSA-qjrm-q4h5-v3r2 published Nov 27, 2023 by timar

High
CVE-2023-34088 Stored Cross-Site-Scripting vulnerability in admin interface
GHSA-7582-pwfh-3pwr published May 31, 2023 by caolanm

Critical
CVE-2023-31145: Reflected XSS vulnerability
GHSA-rqj2-2c2x-gjmm published May 13, 2023 by timar

Moderate

Learn more about advisories related to CollaboraOnline/online in the GitHub Advisory Database