CVE-2020-11537

Description

A SQL Injection issue was discovered in ONLYOFFICE Document Server 5.5.0. An attacker can execute arbitrary SQL queries via injection to DocID parameter of Websocket API.

Risk Information

Base Score

9.8

MODERATE

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Score

Exploitation Probability

0.309

Associated Vulnerability

Vulnerability	OS Platform
Vulnerabilities CVE-2020-11534,CVE-2020-11535,CVE-2020-11536,CVE-2020-11537 are affected in Onlyoffice Document Server 5.5.0	Windows

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234