CVE-2023-30187

An out of bounds memory access vulnerability in ONLYOFFICE DocumentServer 4.0.3 through 7.3.2 allows remote attackers to run arbitrary code via crafted JavaScript file.

Score

CVSS 3.1 9.8 Critical

Status

Modified - cve@mitre.org

Published

2023-08-14

Last modified

2026-07-09

Weaknesses

CWE-787

Affected products

• Document Server (Onlyoffice)

References

• https://gist.github.com/merrychap/25eba8c4dd97c9e545edad1b8f0eadc2
• https://github.com/ONLYOFFICE/DocumentServer
• https://github.com/ONLYOFFICE/core/blob/8ca40a44ce47a86168327a46db91253cf6bb205d/DesktopEditor/doctrenderer/
• https://github.com/ONLYOFFICE/core/blob/8ca40a44ce47a86168327a46db91253cf6bb205d/DesktopEditor/doctrenderer/embed/Nativ…
• https://github.com/ONLYOFFICE/core/commit/2b6ad83b36afd9845085b536969d366d1d61150a