CVE-2019-25258

Опубликовано: 24 дек. 2025

Источник: nvd

CVSS3: 7.5

EPSS Низкий

Описание

LogicalDOC Enterprise 7.7.4 contains multiple post-authentication file disclosure vulnerabilities that allow attackers to read arbitrary files through unverified 'suffix' and 'fileVersion' parameters. Attackers can exploit directory traversal techniques in /thumbnail and /convertpdf endpoints to access sensitive system files like win.ini and /etc/passwd by manipulating path traversal sequences.

Ссылки

https://www.exploit-db.com/exploits/44019
Exploit
Third Party Advisory
https://www.logicaldoc.com
Product
https://www.zeroscience.mk/en/vulnerabilities/ZSL-2018-5450.php
Exploit
Third Party Advisory
https://www.exploit-db.com/exploits/44019
Exploit
Third Party Advisory
https://www.zeroscience.mk/en/vulnerabilities/ZSL-2018-5450.php
Exploit
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:logicaldoc:logicaldoc:7.1.1:*:*:*:enterprise:*:*:*

cpe:2.3:a:logicaldoc:logicaldoc:7.4.2:*:*:*:enterprise:*:*:*

cpe:2.3:a:logicaldoc:logicaldoc:7.5.1:*:*:*:enterprise:*:*:*

cpe:2.3:a:logicaldoc:logicaldoc:7.6.2:*:*:*:enterprise:*:*:*

cpe:2.3:a:logicaldoc:logicaldoc:7.6.4:*:*:*:enterprise:*:*:*

cpe:2.3:a:logicaldoc:logicaldoc:7.7.1:*:*:*:enterprise:*:*:*

cpe:2.3:a:logicaldoc:logicaldoc:7.7.2:*:*:*:enterprise:*:*:*

cpe:2.3:a:logicaldoc:logicaldoc:7.7.3:*:*:*:enterprise:*:*:*

cpe:2.3:a:logicaldoc:logicaldoc:7.7.4:*:*:*:enterprise:*:*:*

EPSS

Процентиль: 80%

0.01382

Низкий

7.5 High

CVSS3

Дефекты

CWE-22

Связанные уязвимости

GHSA-vxcf-c6m5-2m4x