high7.5
CVE-2019-25258
LogicalDOC Enterprise 7.7.4 contains multiple post-authentication file disclosure vulnerabilities that allow attackers to read arbitrary files through unverifi…
Impact
LogicalDOC Enterprise 7.7.4 contains multiple post-authentication file disclosure vulnerabilities that allow attackers to read arbitrary files through unverified 'suffix' and 'fileVersion' parameters. Attackers can exploit directory traversal techniques in /thumbnail and /convertpdf endpoints to access sensitive system files like win.ini and /etc/passwd by manipulating path traversal sequences.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Logicaldoc | Logicaldoc | Versions 7.1.1, 7.4.2, 7.5.1, 7.6.2, 7.6.4, 7.7.1 |