Vulnerability-Lookup

CNVD-2020-25812

Vulnerability from cnvd - Published: 2020-04-30

Title

Ascensio System ONLYOFFICE Document Server SQL注入漏洞

Description

Ascensio System ONLYOFFICE Document Server是拉脱维亚Ascensio System公司的一套在线办公协作套件。该产品支持文本、电子表格和演示文稿的查看和编辑等。 Ascensio System ONLYOFFICE Document Server 5.5.0版本中存在SQL注入漏洞。攻击者可借助Websocket API的‘DocID’参数利用该漏洞执行任意SQL查询。

Severity

高

Patch Name

Ascensio System ONLYOFFICE Document Server SQL注入漏洞的补丁

Patch Description

Formal description

目前厂商已发布升级补丁以修复漏洞，补丁获取链接： https://github.com/ONLYOFFICE/DocumentServer/blob/master/CHANGELOG.md#551

Reference

https://nvd.nist.gov/vuln/detail/CVE-2020-11537

Impacted products

Name
Ascensio System ONLYOFFICE Document Server 5.5.0

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2020-11537"
    }
  },
  "description": "Ascensio System ONLYOFFICE Document Server\u662f\u62c9\u8131\u7ef4\u4e9aAscensio System\u516c\u53f8\u7684\u4e00\u5957\u5728\u7ebf\u529e\u516c\u534f\u4f5c\u5957\u4ef6\u3002\u8be5\u4ea7\u54c1\u652f\u6301\u6587\u672c\u3001\u7535\u5b50\u8868\u683c\u548c\u6f14\u793a\u6587\u7a3f\u7684\u67e5\u770b\u548c\u7f16\u8f91\u7b49\u3002\n\nAscensio System ONLYOFFICE Document Server 5.5.0\u7248\u672c\u4e2d\u5b58\u5728SQL\u6ce8\u5165\u6f0f\u6d1e\u3002\u653b\u51fb\u8005\u53ef\u501f\u52a9Websocket API\u7684\u2018DocID\u2019\u53c2\u6570\u5229\u7528\u8be5\u6f0f\u6d1e\u6267\u884c\u4efb\u610fSQL\u67e5\u8be2\u3002",
  "formalWay": "\u76ee\u524d\u5382\u5546\u5df2\u53d1\u5e03\u5347\u7ea7\u8865\u4e01\u4ee5\u4fee\u590d\u6f0f\u6d1e\uff0c\u8865\u4e01\u83b7\u53d6\u94fe\u63a5\uff1a\r\nhttps://github.com/ONLYOFFICE/DocumentServer/blob/master/CHANGELOG.md#551",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2020-25812",
  "openTime": "2020-04-30",
  "patchDescription": "Ascensio System ONLYOFFICE Document Server\u662f\u62c9\u8131\u7ef4\u4e9aAscensio System\u516c\u53f8\u7684\u4e00\u5957\u5728\u7ebf\u529e\u516c\u534f\u4f5c\u5957\u4ef6\u3002\u8be5\u4ea7\u54c1\u652f\u6301\u6587\u672c\u3001\u7535\u5b50\u8868\u683c\u548c\u6f14\u793a\u6587\u7a3f\u7684\u67e5\u770b\u548c\u7f16\u8f91\u7b49\u3002\r\n\r\nAscensio System ONLYOFFICE Document Server 5.5.0\u7248\u672c\u4e2d\u5b58\u5728SQL\u6ce8\u5165\u6f0f\u6d1e\u3002\u653b\u51fb\u8005\u53ef\u501f\u52a9Websocket API\u7684\u2018DocID\u2019\u53c2\u6570\u5229\u7528\u8be5\u6f0f\u6d1e\u6267\u884c\u4efb\u610fSQL\u67e5\u8be2\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Ascensio System ONLYOFFICE Document Server SQL\u6ce8\u5165\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": "Ascensio System ONLYOFFICE Document Server 5.5.0"
  },
  "referenceLink": "https://nvd.nist.gov/vuln/detail/CVE-2020-11537",
  "serverity": "\u9ad8",
  "submitTime": "2020-04-16",
  "title": "Ascensio System ONLYOFFICE Document Server SQL\u6ce8\u5165\u6f0f\u6d1e"
}

CVE-2020-11537 (GCVE-0-2020-11537)

Vulnerability from cvelistv5 – Published: 2020-04-15 14:56 – Updated: 2024-08-04 11:35

Summary

A SQL Injection issue was discovered in ONLYOFFICE Document Server 5.5.0. An attacker can execute arbitrary SQL queries via injection to DocID parameter of Websocket API.

Severity

No CVSS data available.

CWE

Assigner

mitre

References

2 references

URL	Tags
https://github.com/ONLYOFFICE/DocumentServer/blob…	x_refsource_MISC
https://gist.github.com/andrewaeva/beb92d3d2f1c56…	x_refsource_MISC

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T11:35:13.463Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/ONLYOFFICE/DocumentServer/blob/master/CHANGELOG.md#551"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://gist.github.com/andrewaeva/beb92d3d2f1c5672dbda5050e323f6a0"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A SQL Injection issue was discovered in ONLYOFFICE Document Server 5.5.0. An attacker can execute arbitrary SQL queries via injection to DocID parameter of Websocket API."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-04-15T14:56:05.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/ONLYOFFICE/DocumentServer/blob/master/CHANGELOG.md#551"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://gist.github.com/andrewaeva/beb92d3d2f1c5672dbda5050e323f6a0"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2020-11537",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "A SQL Injection issue was discovered in ONLYOFFICE Document Server 5.5.0. An attacker can execute arbitrary SQL queries via injection to DocID parameter of Websocket API."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/ONLYOFFICE/DocumentServer/blob/master/CHANGELOG.md#551",
              "refsource": "MISC",
              "url": "https://github.com/ONLYOFFICE/DocumentServer/blob/master/CHANGELOG.md#551"
            },
            {
              "name": "https://gist.github.com/andrewaeva/beb92d3d2f1c5672dbda5050e323f6a0",
              "refsource": "MISC",
              "url": "https://gist.github.com/andrewaeva/beb92d3d2f1c5672dbda5050e323f6a0"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2020-11537",
    "datePublished": "2020-04-15T14:56:05.000Z",
    "dateReserved": "2020-04-04T00:00:00.000Z",
    "dateUpdated": "2024-08-04T11:35:13.463Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CNVD-2020-25812

CVE-2020-11537 (GCVE-0-2020-11537)

Tags

Sightings

Nomenclature