CVE-2021-25831: Critical severity onlyoffice vulnerability
A file extension handling issue was found in [core] module of ONLYOFFICE DocumentServer v4.0.0-9-v5.6.3. An attacker must request the conversion of the crafted file from PPTT into PPTX format. Using the chain of two other bugs related to improper string handling, a remote attacker can obtain remote code execution on DocumentServer.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2021-25831?
CVE-2021-25831 is classified as a high severity vulnerability due to its potential for remote code execution.
How do I fix CVE-2021-25831?
To fix CVE-2021-25831, you should update ONLYOFFICE DocumentServer to version 5.6.4 or later.
What kind of attack does CVE-2021-25831 facilitate?
CVE-2021-25831 facilitates remote code execution by allowing an attacker to exploit file conversion processes.
Which versions of ONLYOFFICE DocumentServer are affected by CVE-2021-25831?
CVE-2021-25831 affects ONLYOFFICE DocumentServer versions from 4.0.0-9 up to 5.6.3.
What files are involved in the exploitation of CVE-2021-25831?
The exploitation of CVE-2021-25831 involves the conversion of crafted PPTT files into PPTX format.