CVE-2023-30188
HighCVSS 7.5Exploitation Probability (EPSS)
Elevated risk73th percentile - higher than 73% of all known CVEs
Summary
A memory exhaustion vulnerability in ONLYOFFICE Document Server versions 4.0.3 through 7.3.2 allows a remote attacker to cause a denial of service via a crafted JavaScript file.
Risk Assessment
An attacker can make the document server unavailable, disrupting user operations and potentially requiring manual service restart.
Recommendation
Immediately update ONLYOFFICE Document Server to version 7.3.3 or later, which includes a fix for this vulnerability.
Other vulnerabilities in ONLYOFFICE Document Server
See all- CVE-2021-3199CriticalActively exploited
Directory traversal with remote code execution can occur in /upload in ONLYOFFICE Document Server before 5.6.3, when JWT is used, via a /.. sequence in an image upload parameter.
- CVE-2026-110385High
A remote code execution vulnerability in ONLYOFFICE Document Server versions before 10.0.0 allows an authenticated attacker with a valid JWT to execute arbitrary operating system commands as the ds service account.
Original NVD description (English source)
Memory Exhaustion vulnerability in ONLYOFFICE Document Server 4.0.3 through 7.3.2 allows remote attackers to cause a denial of service via crafted JavaScript file.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS