Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
ONLYOFFICE all versions as of 2021-11-08 is affected by Incorrect Access Control. An attacker can authenticate with the web socket service of the ONLYOFFICE document editor which is protected by JWT auth by using a default JWT signing key.
CVSS Information
N/A
Vulnerability Type
N/A
Vulnerability Title
ONLYOFFICE 授权问题漏洞
Vulnerability Description
Ascensio System ONLYOFFICE是拉脱维亚Ascensio System公司的一款办公软件。 ONLYOFFICE 2021-11-08 之前的所有版本存在安全漏洞，该漏洞源于受不正确的访问控制影响。攻击者可以使用默认的 JWT 签名密钥对受 JWT 身份验证保护的 ONLYOFFICE 文档编辑器的 Web 套接字服务进行身份验证。
CVSS Information
N/A
Vulnerability Type
N/A