CVE-2023-30187

CRITICAL

Onlyoffice Document Server < 7.3.2 - Out-of-Bounds Write

Title source: rule
STIX 2.1

Description

An out of bounds memory access vulnerability in ONLYOFFICE DocumentServer 4.0.3 through 7.3.2 allows remote attackers to run arbitrary code via crafted JavaScript file.

References (6)

Core 6

Scores

CVSS v3 9.8
EPSS 0.0188
EPSS Percentile 83.2%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation poc
Automatable yes
Technical Impact total

Details

CWE
CWE-787
Status published
Products (1)
onlyoffice/document_server 4.0.3 - 7.3.2
Published Aug 14, 2023
Tracked Since Feb 18, 2026