CVE-2023-46988

CVSS 3.1 Score 6.7 of 10 (medium)

Details

Published Apr 1, 2025
Updated: Apr 15, 2025
CWE ID 22

Summary

CVE-2023-46988 is a Path Traversal vulnerability affecting ONLYOFFICE Document Server versions prior to 8.0.1. This issue allows remote attackers to manipulate the fileExt parameter in the /example/editor endpoint, resulting in unauthorized file copying and potential access to sensitive data. Successful exploitation of this vulnerability could lead to unauthorized access to confidential files and potential Denial of Service (DoS) attacks.

Ligh bulbPrevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.

Share

Affected Products

  • ONLYOFFICE Document Server

Affected Vendors

  • OnlyOffice

Advisories, Assessments, and Mitigations