PT-2020-13609 · Logicaldoc · Logicaldoc

Published 2020-12-03 · Updated 2022-06-07 · CVE-2020-13542

Positive Technologies (AI Summary)

CVSS v3.1

9.3

Critical

Base vector

AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions LogicalDoc version 8.5.1

Description A local privilege elevation issue exists in the file system permissions of the LogicalDoc installation. An attacker can replace the service binary or DLL files loaded by the service, which are executed by a service, thus executing arbitrary commands with System privileges.

Recommendations For LogicalDoc version 8.5.1, consider restricting access to the service binary and DLL files loaded by the service to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Incorrect Default Permissions

Weakness Enumeration

CWE-276

Related Identifiers

CVE-2020-13542

Affected Products

Logicaldoc

References · 4

• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2020-1154 · Exploit
• https://osv.dev/vulnerability/CVE-2020-13542 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-13542 · Security Note
• https://t.me/cibsecurity/17104 · Telegram Post