Medium severity · published Aug 29, 2024
CVE-2024-45045
JavaScript Injection via url encoded values in links in Collabora Office Android
6.1
CVSS
0.3%
EPSS
No
On KEV
Description
Collabora Online is a collaborative online office suite based on LibreOffice technology. In the mobile (Android/iOS) device variants of Collabora Online it was possible to inject JavaScript via url encoded values in links contained in documents. Since the Android JavaScript interface allows access to internal functions, the likelihood that the app could be compromised via this vulnerability is considered high. Non-mobile variants are not affected. Mobile variants should update to the latest version provided by the platform appstore. There are no known workarounds for this vulnerability.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 21% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ON
online · CollaboraOnline
Collabora Office (Android): < 24.04.6.2 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-45045
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-45045
Vendor Advisory
https://github.com/CollaboraOnline/online/security/advisories/GHSA-78cg-rg4q-26qv
More from online
9.8
CVE-2025-66208
Configuration-Dependent RCE (OS Command Injection) in richdocumentscode proxy
8.3
CVE-2025-27791
Collabora Online Vulnerable to Arbitrary File Write
8.2
CVE-2024-37311
Collabora Online's remote host TLS certificates are not fully verified
6.3
CVE-2025-24796
Remote Code Execution within Collabora Online jail with Macros Enabled
6.1
CVE-2024-29182
Collabora Online Stored Cross-Site-Scripting vulnerability via tooltip