Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
LogicalDOC Enterprise 7.7.4 Multiple Post-Authentication Directory Traversal Vulnerabilities
Vulnerability Description
LogicalDOC Enterprise 7.7.4 contains multiple post-authentication file disclosure vulnerabilities that allow attackers to read arbitrary files through unverified 'suffix' and 'fileVersion' parameters. Attackers can exploit directory traversal techniques in /thumbnail and /convertpdf endpoints to access sensitive system files like win.ini and /etc/passwd by manipulating path traversal sequences.
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Vulnerability Type
对路径名的限制不恰当(路径遍历)
Vulnerability Title
LogicalDOC Enterprise 安全漏洞
Vulnerability Description
LogicalDOC Enterprise是意大利LogicalDOC公司的一个文档管理系统。 LogicalDOC Enterprise 7.7.4版本存在安全漏洞，该漏洞源于对suffix和fileVersion参数验证不足，可能导致任意文件泄露。
CVSS Information
N/A
Vulnerability Type
N/A