CVE-2019-25258
LogicalDOC Enterprise 7.7.4 contains multiple post-authentication file disclosure vulnerabilities that allow attackers to read arbitrary files through unverified 'suffix' and 'fileVersion' parameters.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (1.14%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
LogicalDOC Enterprise 7.7.4 contains multiple post-authentication file disclosure vulnerabilities that allow attackers to read arbitrary files through unverified 'suffix' and 'fileVersion' parameters. Attackers can exploit directory traversal techniques in /thumbnail and /convertpdf endpoints to access sensitive system files like win.ini and /etc/passwd by manipulating path traversal sequences.
- CVSS 4.0
- 7.1 HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
- EPSS
- 1.14% probability · 65th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-22
- Affected
- logicaldoc/logicaldoc
- Source
- disclosure@vulncheck.com
References
- https://www.exploit-db.com/exploits/44019Exploit, Third Party Advisory
- https://www.logicaldoc.comProduct
- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2018-5450.phpExploit, Third Party Advisory
- https://www.exploit-db.com/exploits/44019Exploit, Third Party Advisory
- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2018-5450.phpExploit, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.