Logicaldoc: >> Logicaldoc >> 4.0.1 Security Vulnerabilities
LogicalDoc before 8.3.3 allows /servlet.gupld Directory Traversal, a different vulnerability than CVE-2020-9423 and CVE-2020-10365.
CVSS Score
7.5
EPSS Score
0.004
Published
2020-04-08
LogicalDoc before 8.3.3 allows SQL Injection. LogicalDoc populates the list of available documents by querying the database. This list could be filtered by modifying some of the parameters. Some of them are not properly sanitized which could allow an authenticated attacker to perform arbitrary queries to the database.
CVSS Score
6.5
EPSS Score
0.004
Published
2020-03-18
LogicalDoc before 8.3.3 could allow an attacker to upload arbitrary files, leading to command execution or retrieval of data from the database. LogicalDoc provides a functionality to add documents. Those documents could then be used for multiple tasks, such as version control, shared among users, applying tags, etc. This functionality could be abused by an unauthenticated attacker to upload an arbitrary file in a restricted folder. This would lead to the executions of malicious commands with root privileges.
CVSS Score
9.8
EPSS Score
0.015
Published
2020-03-18
LogicalDoc Community Edition 7.5.3 and prior is vulnerable to XXE when indexing XML documents.
CVSS Score
8.8
EPSS Score
0.007
Published
2017-07-17
LogicalDoc Community Edition 7.5.3 and prior contain an Incorrect access control which could leave to privilege escalation.
CVSS Score
8.8
EPSS Score
0.003
Published
2017-07-17
LogicalDoc Community Edition 7.5.3 and prior is vulnerable to an XSS when using preview on HTML document.
CVSS Score
5.4
EPSS Score
0.002
Published
2017-07-17