CVE-2019-25258: LogicalDOC Enterprise 7.7.4 Multiple Post-Authentication Directory Traversal Vulnerabilities
LogicalDOC Enterprise 7.7.4 contains multiple post-authentication file disclosure vulnerabilities that allow attackers to read arbitrary files through unverified 'suffix' and 'fileVersion' parameters. Attackers can exploit directory traversal techniques in /thumbnail and /convertpdf endpoints to access sensitive system files like win.ini and /etc/passwd by manipulating path traversal sequences.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2019-25258?
CVE-2019-25258 is categorized as a high severity vulnerability due to its potential to expose sensitive files post-authentication.
How do I fix CVE-2019-25258?
To fix CVE-2019-25258, ensure that file access controls are properly implemented and validate the 'suffix' and 'fileVersion' parameters.
What types of attacks can exploit CVE-2019-25258?
CVE-2019-25258 can be exploited through directory traversal attacks allowing unauthorized file access.
Which versions of LogicalDOC are affected by CVE-2019-25258?
CVE-2019-25258 affects LogicalDOC Enterprise version 7.7.4 and possibly earlier versions.
How can I detect if CVE-2019-25258 has been exploited in my system?
You can detect exploitation of CVE-2019-25258 by monitoring access logs for unusual file read requests and verifying file system integrity.