CVE-2020-11535: Critical severity onlyoffice vulnerability
Published Apr 15, 2020
·Updated
An issue was discovered in ONLYOFFICE Document Server 5.5.0. An attacker can craft a malicious .docx file, and exploit XML injection to enter an attacker-controlled parameter into the x2t binary, to rewrite this binary and/or libxcb.so.1, and execute code on a victim's server.
Affected Software
1 affected component
Onlyoffice Document Server=5.5.0
Event History
Apr 15, 2020
CVE Published
via MITRE·02:56 PM
Data Sourced
via MITRE·02:56 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2020-11535?
CVE-2020-11535 is classified as a critical vulnerability due to its potential to allow remote code execution.
2
How do I fix CVE-2020-11535?
To fix CVE-2020-11535, upgrade ONLYOFFICE Document Server to version 5.5.1 or later.
3
Who is affected by CVE-2020-11535?
ONLYOFFICE Document Server version 5.5.0 is affected by CVE-2020-11535.
4
What type of attack is associated with CVE-2020-11535?
CVE-2020-11535 involves an XML injection attack via a crafted .docx file.
5
What impacts does CVE-2020-11535 have on systems?
CVE-2020-11535 can allow an attacker to execute arbitrary code on the victim's server.