Unscored CVE-2023-34939 EUVD-2023-38978GHSA-8rx2-c38v-6hm8

Onlyoffice Community Server before v12.5.2 was discovered to contain a remote code execution (RCE) vulnerability via the component UploadPr…

Published Jun 22, 2023 · Updated Dec 6, 2024 · Assigned by mitre

Description

Onlyoffice Community Server before v12.5.2 was discovered to contain a remote code execution (RCE) vulnerability via the component UploadProgress.ashx.

References

https://github.com/firsov/onlyoffice
https://github.com/ONLYOFFICE/CommunityServer/blob/master/CHANGELOG.md#version-1252
https://github.com/firsov/onlyoffice/blob/main/CVE-2023-34939-PoC.md