Vulnerability Details : CVE-2023-30186
Potential exploit
A use after free issue discovered in ONLYOFFICE DocumentServer 4.0.3 through 7.3.2 allows remote attackers to run arbitrary code via crafted JavaScript file.
Vulnerability category: Memory Corruption
Products affected by CVE-2023-30186
- cpe:2.3:a:onlyoffice:document_server:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2023-30186
1.06%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 84 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2023-30186
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
---|---|---|---|---|---|---|
9.8
|
CRITICAL | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
3.9
|
5.9
|
NIST |
CWE ids for CVE-2023-30186
-
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.Assigned by: nvd@nist.gov (Primary)
References for CVE-2023-30186
-
https://gist.github.com/merrychap/25eba8c4dd97c9e545edad1b8f0eadc2
CVE-2023-30186, CVE-2023-30187, CVE-2023-30188 · GitHubExploit;Patch;Third Party Advisory
-
https://github.com/ONLYOFFICE/core/blob/8ca40a44ce47a86168327a46db91253cf6bb205d/DesktopEditor/doctrenderer/
core/DesktopEditor/doctrenderer at 8ca40a44ce47a86168327a46db91253cf6bb205d · ONLYOFFICE/core · GitHubProduct
-
https://github.com/ONLYOFFICE/DocumentServer
GitHub - ONLYOFFICE/DocumentServer: ONLYOFFICE Document Server is an online office suite comprising viewers and editors for texts, spreadsheets and presentations, fully compatible with Office Open XMLProduct
-
http://onlyoffice.com
ONLYOFFICE - Secure Online Office | ONLYOFFICEProduct
-
https://github.com/ONLYOFFICE/core/blob/8ca40a44ce47a86168327a46db91253cf6bb205d/DesktopEditor/doctrenderer/embed/NativeControlEmbed.cpp#L110
core/DesktopEditor/doctrenderer/embed/NativeControlEmbed.cpp at 8ca40a44ce47a86168327a46db91253cf6bb205d · ONLYOFFICE/core · GitHubNot Applicable
-
https://github.com/ONLYOFFICE/core/commit/2b6ad83b36afd9845085b536969d366d1d61150a
Fix bug 60433 · ONLYOFFICE/core@2b6ad83 · GitHubPatch;Vendor Advisory
Jump to