Description (CNA)
LogicalDOC Enterprise 7.7.4 contains multiple post-authentication file disclosure vulnerabilities that allow attackers to read arbitrary files through unverified 'suffix' and 'fileVersion' parameters. Attackers can exploit directory traversal techniques in /thumbnail and /convertpdf endpoints to access sensitive system files like win.ini and /etc/passwd by manipulating path traversal sequences.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| LogicalDOC Srl / LogicalDOC Enterprise | affected 7.7.4; affected 7.7.3; affected 7.7.2; affected 7.7.1; affected 7.6.4; affected 7.6.2; affected 7.5.1; affected 7.4.2; affected 7.1.1 |
CWE
CWE-22
References
- https://www.exploit-db.com/exploits/44019
- https://www.logicaldoc.com
- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2018-5450.php
ADP enrichment
No English description supplied.