CVE-2023-30188

Опубликовано: 14 авг. 2023

Источник: nvd

CVSS3: 7.5

EPSS Низкий

Описание

Memory Exhaustion vulnerability in ONLYOFFICE Document Server 4.0.3 through 7.3.2 allows remote attackers to cause a denial of service via crafted JavaScript file.

Ссылки

http://onlyoffice.com
Product
https://gist.github.com/merrychap/25eba8c4dd97c9e545edad1b8f0eadc2
Exploit
Patch
Third Party Advisory
https://github.com/ONLYOFFICE/DocumentServer
Product
https://github.com/ONLYOFFICE/core/blob/8ca40a44ce47a86168327a46db91253cf6bb205d/DesktopEditor/doctrenderer/
Product
https://github.com/ONLYOFFICE/core/blob/8ca40a44ce47a86168327a46db91253cf6bb205d/DesktopEditor/doctrenderer/embed/NativeControlEmbed.cpp#L110
Not Applicable
https://github.com/ONLYOFFICE/core/commit/2b6ad83b36afd9845085b536969d366d1d61150a
Patch
Vendor Advisory
http://onlyoffice.com
Product
https://gist.github.com/merrychap/25eba8c4dd97c9e545edad1b8f0eadc2
Exploit
Patch
Third Party Advisory
https://github.com/ONLYOFFICE/DocumentServer
Product
https://github.com/ONLYOFFICE/core/blob/8ca40a44ce47a86168327a46db91253cf6bb205d/DesktopEditor/doctrenderer/
Product
https://github.com/ONLYOFFICE/core/blob/8ca40a44ce47a86168327a46db91253cf6bb205d/DesktopEditor/doctrenderer/embed/NativeControlEmbed.cpp#L110
Not Applicable
https://github.com/ONLYOFFICE/core/commit/2b6ad83b36afd9845085b536969d366d1d61150a
Patch
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:onlyoffice:document_server:*:*:*:*:*:*:*:*

Версия от 4.0.3 (включая) до 7.3.2 (включая)

EPSS

Процентиль: 74%

0.00846

Низкий

7.5 High

CVSS3

Дефекты

CWE-835

Связанные уязвимости

GHSA-xg67-jwrg-pjc6

CVSS3: 5.5

github

больше 2 лет назад