Security readout for executives and security teams
Plain-English summary
CVE-2021-43447 is an ONLYOFFICE document editor authentication bypass. A remote attacker could edit documents without logging in, creating a serious document integrity risk for organizations using exposed ONLYOFFICE services.
Executive priority
High priority for any organization using ONLYOFFICE to manage sensitive or business-critical documents, especially if exposed to the internet. The main business risk is unauthorized alteration of documents, contracts, reports, or operational records.
Technical view
The CVE maps to CWE-306 with CVSS 3.1 score 7.5: network reachable, low complexity, no privileges, no user interaction, high integrity impact. The described impact is unauthorized document editing.
Likely exposure
Exposure is most likely where ONLYOFFICE document editor or server components are network reachable. The source bundle says all versions as of 2021-11-08 were affected, but structured affected product and version fields are incomplete.
Exploitation context
The bundle references public research on ONLYOFFICE WebSocket exploitation, but does not provide KEV status or direct evidence of active exploitation. Treat this as plausibly exploitable, not confirmed exploited in the wild.
Researcher notes
Evidence is limited to the CVE description, CVSS vector, CWE mapping, and public references. The bundle does not identify exact fixed versions, affected CPEs, or a vendor advisory, so remediation should be anchored to current ONLYOFFICE guidance.
Mitigation direction
- Identify all ONLYOFFICE deployments and whether document editor services are externally reachable.
- Check ONLYOFFICE vendor guidance and release notes for fixed versions or configuration mitigations.
- Restrict access to trusted networks or authenticated reverse proxies where business workflows permit.
- Review document edit history for unauthorized modifications around exposed deployments.
- Prioritize upgrade or compensating controls for internet-facing instances.
Validation and detection
- Inventory ONLYOFFICE server and document editor versions across production and staging.
- Confirm whether unauthenticated users can reach document editing endpoints.
- Review access logs for anonymous or unexpected document editing activity.
- Verify external exposure using approved asset inventory and perimeter scanning results.
- Document any compensating controls blocking unauthenticated editor access.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-306: Credential and account abuse lookup
Authentication and credential weaknesses can make valid-account abuse and credential telemetry useful review starting points. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCredential and access behavior lookup
The CVE wording references authentication or credential exposure, so valid-account and credential-access review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2021-43447 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N3.93.6Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
7.5HighVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/ONLYOFFICE/serverCVE reference
- https://www.onlyoffice.com/CVE reference
- https://labs.nettitude.com/blog/exploiting-onlyoffice-web-sockets-for-unauthenticated-remote-code-execution/CVE reference
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Missing Authentication for Critical Function
Missing Authentication for Critical Function represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.