Privilege Escalation Vulnerability in ONLYOFFICE Docs by ONLYOFFICE
CVE-2022-48422

7.8HIGH

Key Information:

Vendor

Onlyoffice

Status
Document Server
Vendor
CVE Published:
19 March 2023

What is CVE-2022-48422?

On certain Linux distributions, ONLYOFFICE Docs versions up to 7.3 are susceptible to a privilege escalation vulnerability. Local users can exploit a maliciously crafted libgcc_s.so.1 file located in the current working directory of ONLYOFFICE documents to gain elevated privileges, potentially compromising the entire system's security. This issue underscores the importance of monitoring directory contents and securing file permissions to mitigate local threat vectors.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

References

https://forum.onlyoffice.com/t/security-hole-library-from...

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.