Description
LogicalDOC Community Edition through 9.3 contains an improper authorization vulnerability in the PswRecovery servlet that fails to bind password recovery tickets to the requesting user. Attackers can obtain a ticket for their own account and reuse it with any userId, including administrators, to reset victims' passwords, lock them out, and reveal their email addresses.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| LogicalDOC | LogicalDOC Community Edition | ≤ 9.3 | — |
References
- https://github.com/logicaldoc/community/discussions/119 technical-description
- Patch Commit patch
- https://github.com/logicaldoc/community/blob/9.3/logicaldoc-webapp/src/main/java/com/logicaldoc/web/PswRecovery.java#L101 technical-description
- https://github.com/logicaldoc/community product
- VulnCheck Advisory: LogicalDOC Community Edition through 9.3 Forced Password Reset via Unbound PswRecovery Ticket third-party-advisory