CVE-2020-9423: Malicious File Upload
LogicalDoc before 8.3.3 could allow an attacker to upload arbitrary files, leading to command execution or retrieval of data from the database. LogicalDoc provides a functionality to add documents. Those documents could then be used for multiple tasks, such as version control, shared among users, applying tags, etc. This functionality could be abused by an unauthenticated attacker to upload an arbitrary file in a restricted folder. This would lead to the executions of malicious commands with root privileges.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
LogicalDocto a version that resolves this vulnerability.Fixed in 8.3.3
Event History
Frequently Asked Questions
What is the severity of CVE-2020-9423?
CVE-2020-9423 has a critical severity rating due to its potential to allow arbitrary file uploads leading to command execution.
How do I fix CVE-2020-9423?
To fix CVE-2020-9423, upgrade to LogicalDoc version 8.3.3 or later, which addresses the vulnerability.
What impact does CVE-2020-9423 have on my system?
CVE-2020-9423 can allow attackers to execute commands or access sensitive data from the database, jeopardizing system integrity.
Who is affected by CVE-2020-9423?
Users of LogicalDoc versions prior to 8.3.3 are affected by CVE-2020-9423, making them vulnerable to file upload exploits.
Is it possible to exploit CVE-2020-9423 remotely?
Yes, CVE-2020-9423 can be exploited remotely, enabling attackers to manipulate file uploads without physical access.