Unpatched Security Flaws Disclosed in Multiple Document Management Systems

Many unpatched security flaws have been disclosed in open source and freemium Doc Management Program (DMS) offerings from four vendors LogicalDOC, Mayan, ONLYOFFICE, and OpenKM.

Cybersecurity company Rapid7 reported the 8 vulnerabilities offer you a mechanism as a result of which “an attacker can convince a human operator to conserve a malicious document on the platform and, once the doc is indexed and brought on by the person, supplying the attacker a number of paths to management the organization.”

The checklist of eight cross-web page scripting (XSS) flaws, found out by Rapid7 researcher Matthew Kienow, is as follows –

✔ Approved Seller From Our Partners

Protect your privacy by Mullvad VPN. Mullvad VPN is one of the famous brands in the security and privacy world. With Mullvad VPN you will not even be asked for your email address. No log policy, no data from you will be saved. Get your license key now from the official distributor of Mullvad with discount: SerialCart® (Limited Offer).

➤ Get Mullvad VPN with 12% Discount

• CVE-2022-47412 – ONLYOFFICE Workspace Research Saved XSS
• CVE-2022-47413 and CVE-2022-47414 – OpenKM Document and Application XSS
• CVE-2022-47415, CVE-2022-47416, CVE-2022-47417, and CVE-2022-47418 – LogicalDOC Multiple Saved XSS
• CVE-2022-47419 – Mayan EDMS Tag Saved XSS

Saved XSS, also acknowledged as persistent XSS, occurs when a destructive script is injected directly into a susceptible web software (e.g., through a remark area), causing the rogue code to be activated upon each individual visit to the software.

A risk actor can exploit the aforementioned flaws by giving a decoy document, granting the interloper the skill to additional their regulate about the compromised network,

“A usual attack sample would be to steal the session cookie that a regionally-logged in administrator is authenticated with, and reuse that session cookie to impersonate that consumer to make a new privileged account,” Tod Beardsley, director of investigate at Immediate7, reported.

In an choice situation, the attacker could abuse the identification of the victim to inject arbitrary commands and obtain stealthy obtain to the stored documents.

The cybersecurity firm mentioned that the flaws were described to the respective distributors on December 1, 2022, and continue to remain unfixed irrespective of coordinating the disclosures with CERT Coordination Center (CERT/CC).

Buyers of the impacted DMS are recommended to move forward with caution when importing documents from mysterious or untrusted resources as properly as limit the development of nameless, untrusted consumers and prohibit selected functions these as chats and tagging to identified buyers.

Found this report intriguing? Follow us on Twitter  and LinkedIn to browse additional distinctive articles we post.