Vulnerability Details : CVE-2023-30188
Memory Exhaustion vulnerability in ONLYOFFICE Document Server 4.0.3 through 7.3.2 allows remote attackers to cause a denial of service via crafted JavaScript file.
Vulnerability category: Denial of service
Products affected by CVE-2023-30188
- cpe:2.3:a:onlyoffice:document_server:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2023-30188
0.40%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 74 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2023-30188
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
7.5
|
HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
3.9
|
3.6
|
NIST |
CWE ids for CVE-2023-30188
-
The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.Assigned by: nvd@nist.gov (Primary)
References for CVE-2023-30188
-
https://gist.github.com/merrychap/25eba8c4dd97c9e545edad1b8f0eadc2
CVE-2023-30186, CVE-2023-30187, CVE-2023-30188 · GitHubExploit;Patch;Third Party Advisory
-
https://github.com/ONLYOFFICE/core/blob/8ca40a44ce47a86168327a46db91253cf6bb205d/DesktopEditor/doctrenderer/
core/DesktopEditor/doctrenderer at 8ca40a44ce47a86168327a46db91253cf6bb205d · ONLYOFFICE/core · GitHubProduct
-
https://github.com/ONLYOFFICE/DocumentServer
GitHub - ONLYOFFICE/DocumentServer: ONLYOFFICE Document Server is an online office suite comprising viewers and editors for texts, spreadsheets and presentations, fully compatible with Office Open XMLProduct
-
http://onlyoffice.com
ONLYOFFICE - Secure Online Office | ONLYOFFICEProduct
-
https://github.com/ONLYOFFICE/core/blob/8ca40a44ce47a86168327a46db91253cf6bb205d/DesktopEditor/doctrenderer/embed/NativeControlEmbed.cpp#L110
core/DesktopEditor/doctrenderer/embed/NativeControlEmbed.cpp at 8ca40a44ce47a86168327a46db91253cf6bb205d · ONLYOFFICE/core · GitHubNot Applicable
-
https://github.com/ONLYOFFICE/core/commit/2b6ad83b36afd9845085b536969d366d1d61150a
Fix bug 60433 · ONLYOFFICE/core@2b6ad83 · GitHubPatch;Vendor Advisory
Jump to