CVE-2023-48314 HIGH

CVE-2023-48314: Unescaped passing of the request URL in Collabora Online

Vendor Collaboraonline
Product online
Weakness CWE-79 · XSS
Published December 1, 2023
Last update June 3, 2025
View on NVD All CVEs

CVSS base score

7.1/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction Required
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

What the vulnerability does

01Description

Collabora Online is a collaborative online office suite based on LibreOffice technology. Users of Nextcloud with Collabora Online Built-in CODE Server app can be vulnerable to attack via proxy.php. This vulnerability has been fixed in Collabora Online - Built-in CODE Server (richdocumentscode) release 23.5.403. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Key dates

02Disclosure timeline

December 1, 2023 CVE published
June 3, 2025 Record updated

Related vulnerabilities

04Related CVE

CVE-2024-30548 WordPress underConstruction plugin <= 1.21 - Cross Site Scripting (XSS) vulnerability CVE-2025-23850 WordPress Mojo Under Construction Plugin <= 1.1.2 - Reflected Cross Site Scripting (XSS) vulnerability CVE-2013-10021 dd32 Debug Bar Plugin class-debug-bar-queries.php render cross site scripting CVE-2025-30600 WordPress WP Hotjar plugin <= 0.0.3 - Cross Site Scripting (XSS) vulnerability CVE-2024-37100 WordPress Elegant Themes Icons plugin <= 1.3 - Cross Site Scripting (XSS) vulnerability