Threat database

LogicalDOC Community Edition versions up to 9.3 contain a username enumeration vulnerability via the AvatarServlet endpoint. This flaw allows unauthenticated attackers to supply usernames or numeric IDs to the userId parameter and observe differences in returned avatar images, enabling them to confirm valid user accounts and retrieve profile pictures. The vulnerability does not require authentication and has a CVSS 4.0 base score of 6.9, indicating medium severity.

LogicalDOC Community Edition versions up to 9.3 contain an unauthenticated file upload vulnerability in the UploadServlet. This flaw allows remote attackers to upload files repeatedly without a session, causing uncleaned temporary files to accumulate and potentially exhaust server disk space. The vulnerability has a high severity score of 8.7 and does not require user interaction or privileges.

LogicalDOC Community Edition versions up to 9.3 have an improper authorization vulnerability in the password recovery mechanism. The PswRecovery servlet does not properly bind password recovery tickets to the requesting user, allowing attackers to reuse tickets across different user accounts, including administrators. This can enable attackers to reset passwords, lock out users, and reveal email addresses.

LogicalDOC Community Edition versions up to 9.3 have a missing authorization vulnerability in the ConvertPdf servlet. Authenticated users can exploit this flaw to download restricted PDF documents by enumerating sequential document IDs and using the version parameter to access PDFs and their versions from folders they should not have access to.

LogicalDOC Community Edition versions up to 9.3 contain a missing authorization vulnerability in the zip-export servlet. Authenticated users can exploit this flaw by supplying a folderId parameter to export restricted folders without proper permission checks. This allows unauthorized downloading of all documents within those folders as a ZIP archive.

LogicalDOC Community Edition versions up to 9.3 have a missing authorization vulnerability in the SoapDocumentService operations. Authenticated users can exploit this flaw to access and modify documents they are not authorized to handle by invoking certain SOAP or REST document service operations with sequential document IDs. This can lead to unauthorized disclosure, deletion, or tampering of documents.

LogicalDOC Community Edition versions up to 9.3 contain a server-side request forgery (SSRF) vulnerability in the default-enabled XMLConverter component. Authenticated users can upload XML documents with stylesheet href attributes that reference internal URLs using http, ftp, file, or jar schemes. This allows the server to make unintended requests and apply attacker-controlled XSLT during document conversion, potentially leading to unauthorized internal resource access or manipulation.

LogicalDOC Community Edition versions up to 9.3 contain a code injection vulnerability that allows authenticated users to execute arbitrary OS commands. This is achieved by submitting malicious Velocity templates in the DocumentService.sendAsEmail subject or message fields, enabling attackers to bypass runtime usage restrictions and execute commands with the privileges of the LogicalDOC process.

LogicalDOC Community Edition versions up to 9.3 contain an HQL injection vulnerability in the DocumentsDataServlet component. Authenticated users with read access to any folder can exploit this flaw by manipulating the 'indexed' parameter, allowing them to inject boolean HQL expressions. This bypasses folder scope and read-permission checks, enabling unauthorized listing of restricted document metadata and extraction of database contents. The vulnerability has a high severity rating with a CVSS 4.0 score of 7.1.

LogicalDOC Community Edition versions up to 9.3 contain a SQL injection vulnerability in the TagsDataServlet component. Authenticated low-privileged users can exploit this flaw by injecting crafted SQL via the firstLetter parameter, enabling them to retrieve sensitive information such as usernames, email addresses, and password hashes. The vulnerability has a high severity rating with a CVSS 4.0 score of 7.1.

A vulnerability was identified in LogicalDOC Community Edition up to 9.2.1. This vulnerability affects unknown code of the file /login.jsp of the component Admin Login Page. Such manipulation leads to improper restriction of excessive authentication attempts. The attack can be executed remotely. This attack is characterized by high complexity. It is stated that the exploitability is difficult. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability was determined in LogicalDOC Community Edition up to 9.2.1. This affects an unknown part of the component API Key creation UI. This manipulation causes cross site scripting. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

A security flaw has been discovered in LogicalDOC Community Edition up to 9.2.1. This issue affects some unknown processing of the file /frontend.jsp of the component Add Contact Page. Performing manipulation of the argument First Name/Last Name/Company/Address/Phone/Mobile results in cross site scripting. Remote exploitation of the attack is possible. The exploit has been released to the public and may be exploited. The vendor was contacted early about this disclosure but did not respond in any way.

CVE-2024-54448 is a high-severity vulnerability in LogicalDOC Community's Automation Scripting feature that allows attackers with administrator privileges or explicit Automation Scripting access to execute arbitrary system commands on the underlying operating system. This code injection vulnerability (CWE-94) could enable attackers to run commands of their choice on the web server hosting LogicalDOC. No patch or official remediation guidance is currently confirmed.