CVE-2025-5301

Reflected Cross-Site Scripting in ONLYOFFICE Docs (DocumentServer)

CVSS 6.1 MEDIUMEPSS 34.9%CWE-79

Vexday Risk Score

40Atención

Decisión SSVC (CISA)

Attend

PoC disponible → seguir de cerca

CVSS 6.1EPSS 34.9%KEV nãoPoC —Nuclei simMetasploit —Patch —

Ciclo de vida

12 jun 2025Publicada en NVD

Recomendación: Planificar corrección próxima — ya existe PoC pública.

ONLYOFFICE Docs (DocumentServer) in versions equal and below 8.3.1 are affected by a reflected cross-site scripting (XSS) issue when opening files via the WOPI protocol. Attackers could inject malicious scripts via crafted HTTP POST requests, which are then reflected in the server's HTML response.

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Productos afectados

OnlyOffice · Docs (DocumentServer)

¿Quieres saber si tu infraestructura está expuesta a esto?

Hablar con TrueHacking →

Referencias

http://seclists.org/fulldisclosure/2025/Jun/18 https://github.com/ONLYOFFICE/DocumentServer/blob/master/CHANGELOG.md#832 https://r.sec-consult.com/onlyoffice https://sec-consult.com/vulnerability-lab/advisory/reflected-cross-site-scripting-in-onlyoffice-docs-documentserver/