CVE-2024-12020 is a reflected cross-site scripting (XSS) vulnerability found in JSP files that control the appearance of the LogicalDOC Enterprise application. An unauthenticated attacker can craft a malicious link to exploit this vulnerability by tricking a user into clicking it. While stealing session cookies is prevented by cookie security flags, the XSS can be leveraged to perform unauthorized on-site requests on behalf of the victim. This vulnerability affects only LogicalDOC Enterprise and has a medium severity rating with a CVSS score of 6.1.