Security Advisories
CVEs affecting projects tracked on Release Alert, from NVD & OSV.
CVE-2021-25830
9.8
CRITICALCVSS v3
Published
March 1, 2021
CVSS v2
7.5 HIGH
Affected
2 projects
Assigned by
MITRE
Severity scale
010
Description
A file extension handling issue was found in [core] module of ONLYOFFICE DocumentServer v4.2.0.236-v5.6.4.13. An attacker must request the conversion of the crafted file from DOCT into DOCX format. Using the chain of two other bugs related to improper string handling, an attacker can achieve remote code execution on DocumentServer.
ONLYOFFICE/DocumentServer
GitHubONLYOFFICE Docs is a free collaborative online office suite comprising viewers and editors for texts, spreadsheets and presentations, forms and PDF, fully compatible with Office Open XML formats: .docx, .xlsx, .pptx and enabling collaborative editing in real time.
GitHubONLYOFFICE Docs is a free collaborative online office suite comprising viewers and editors for texts, spreadsheets and presentations, forms and PDF, fully compatible with Office Open XML formats: .docx, .xlsx, .pptx and enabling collaborative editing in real time.>= 4.2.0.236, <= 5.6.4.13NVD