Описание
An out of bounds memory access vulnerability in ONLYOFFICE DocumentServer 4.0.3 through 7.3.2 allows remote attackers to run arbitrary code via crafted JavaScript file.
An out of bounds memory access vulnerability in ONLYOFFICE DocumentServer 4.0.3 through 7.3.2 allows remote attackers to run arbitrary code via crafted JavaScript file.
Ссылки
- https://nvd.nist.gov/vuln/detail/CVE-2023-30187
- https://github.com/ONLYOFFICE/core/commit/2b6ad83b36afd9845085b536969d366d1d61150a
- https://gist.github.com/merrychap/25eba8c4dd97c9e545edad1b8f0eadc2
- https://github.com/ONLYOFFICE/DocumentServer
- https://github.com/ONLYOFFICE/core/blob/8ca40a44ce47a86168327a46db91253cf6bb205d/DesktopEditor/doctrenderer
- https://github.com/ONLYOFFICE/core/blob/8ca40a44ce47a86168327a46db91253cf6bb205d/DesktopEditor/doctrenderer/embed/NativeControlEmbed.cpp#L110
- http://onlyoffice.com
Связанные уязвимости
CVSS3: 9.8
nvd
больше 2 лет назад
An out of bounds memory access vulnerability in ONLYOFFICE DocumentServer 4.0.3 through 7.3.2 allows remote attackers to run arbitrary code via crafted JavaScript file.
CVSS3: 7.8
fstec
больше 2 лет назад
Уязвимость компонента JavaScript File Handler офисного онлайн-пакета ONLYOFFICE DocumentServer, позволяющая нарушителю выполнить произвольный код