Vulnerability in LogicalDOC Community Edition

[ Description ]Official description

LogicalDOC Community Edition through 9.3 contains an improper authorization vulnerability in the PswRecovery servlet that fails to bind password recovery tickets to the requesting user. Attackers can obtain a ticket for their own account and reuse it with any userId, including administrators, to reset victims' passwords, lock them out, and reveal their email addresses.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ References ]References

• github.com/logicaldoc/community
• github.com/logicaldoc/community/blob/9.3/logicaldoc-webapp/src/main/java/com/logicaldoc…
• github.com/logicaldoc/community/commit/afc8554e6654865295bffc8f080c7cb899caf057
• github.com/logicaldoc/community/discussions/119
• www.vulncheck.com/advisories/logicaldoc-community-edition-through-9.3-forced-password-r…