by Kastro
Paper/Archive/CVE-2023-30187

CVE-2023-30187

mitre — An out of bounds memory access vulnerability in ONLYOFFICE DocumentServer 4.0.3 through 7.3.2 allows remote attackers to run arbitrary co…

EPSS 2%public exploitCVSS 9.8
critical.is priorityof 100
56
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 83.8.838 × 2016.8Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

An out of bounds memory access vulnerability in ONLYOFFICE DocumentServer 4.0.3 through 7.3.2 allows remote attackers to run arbitrary code via crafted JavaScript file.

Affected

ProductAffectedFixed inSource
n/an/a–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

refgithub.com/ONLYOFFICE/DocumentServerrefgithub.com/ONLYOFFICE/core/blob/8ca40a44ce47a86168327a46db91253cf6bb205d/DesktopEditor/doctrendererrefgithub.com/ONLYOFFICE/core/blob/8ca40a44ce47a86168327a46db91253cf6bb205d/DesktopEditor/doctrenderer/embed/NativeControlEmbed.cpp#L110refgithub.com/ONLYOFFICE/core/commit/2b6ad83b36afd9845085b536969d366d1d61150arefgist.github.com/merrychap/25eba8c4dd97c9e545edad1b8f0eadc2