CVE-2020-11537

EUVD-2020-3889
A SQL Injection issue was discovered in ONLYOFFICE Document Server 5.5.0. An attacker can execute arbitrary SQL queries via injection to DocID parameter of Websocket API.
SQL Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
9.8 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 53%
Affected Products (NVD)
VendorProductVersion
onlyofficedocument_server
5.5.0
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://gist.github.com/andrewaeva/beb92d3d2f1c5672dbda5050e323f6a0
https://github.com/ONLYOFFICE/DocumentServer/blob/master/CHANGELOG.md#551
https://gist.github.com/andrewaeva/beb92d3d2f1c5672dbda5050e323f6a0
https://github.com/ONLYOFFICE/DocumentServer/blob/master/CHANGELOG.md#551