High severity7.5NVD Advisory· Published Jan 23, 2023· Updated Jun 17, 2026

CVE-2021-43444

Description

ONLYOFFICE all versions as of 2021-11-08 is affected by Incorrect Access Control. Signed document download URLs can be forged due to a weak default URL signing key.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

ONLYOFFICE/ONLYOFFICEdescription
ONLYOFFICE/ONLYOFFICEllm-create
Range: <2021-11-08
ONLYOFFICE/serverllm-create
Range: <2021-11-08

Patches

Vulnerability mechanics

References

labs.nettitude.com/blog/exploiting-onlyoffice-web-sockets-for-unauthenticated-remote-code-execution/nvdMitigationThird Party Advisory
www.onlyoffice.comnvdProductVendor Advisory

News mentions

No linked articles in our index yet.

cvss	0.488
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000