CVE-2023-31145 (online)

Collabora Online is a collaborative online office suite based on LibreOffice technology. This vulnerability report describes a reflected XSS vulnerability with full CSP bypass in Nextcloud installations using the recommended bundle. The vulnerability can be exploited to perform a trivial account takeover attack. The vulnerability allows attackers to inject malicious code into web pages, which can be executed in the context of the victim's browser session. This means that an attacker can steal sensitive data, such as login credentials or …

account account takeover attack attackers bundle bypass code csp cve exploited inject libreoffice malicious nextcloud office reflected xss report takeover technology vulnerability web xss