CVE-2024-12019
High
Description
The API used to interact with documents in the application contains a flaw that allows an authenticated attacker to read the contents of files on the underlying operating system. An account with ‘read’ and ‘download’ privileges on at least one existing document in the application is required to exploit the vulnerability. Exploitation of this vulnerability would allow an attacker to read the contents of any file available within the privileges of the system user running the application.
SeverityHigh
CVSS7.1
Exploit probability—
ProductLogicalDOC Community
PublishedMar 14, 2025
First seenMar 14, 2025
Weakness typeCWE-23CWE-23
How to fix
Update
- LogicalDOC LogicalDOC Community9.1 or later
- LogicalDOC LogicalDOC Enterprise9.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| LogicalDOC LogicalDOC Community | v < 9.1 | 9.1 |
| LogicalDOC LogicalDOC Enterprise | v < 9.1 | 9.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.