CVE-2020-11535

Name of the Vulnerable Software and Affected Versions ONLYOFFICE Document Server version 5.5.0

Description An issue was discovered that allows an attacker to craft a malicious .docx file and exploit XML injection. This can lead to entering an attacker-controlled parameter into the x2t binary, potentially allowing the attacker to rewrite the binary and/or libxcb.so.1, and execute code on a victim's server.

Recommendations For ONLYOFFICE Document Server version 5.5.0, consider restricting the processing of .docx files from untrusted sources until a fix is available. As a temporary workaround, restrict access to the x2t binary to minimize the risk of exploitation.