Through the course of routine security testing and analysis, Rapid7 has discovered several issues in on-premises installations of open source and freemium Document Management System (DMS) offerings from four vendors. While all of the discovered issues are instances of CWE-79: Improper Neutralization of Input During Web Page Generation, in this disclosure, we have ordered them from most severe to least.
The issues are summarized in the table below.
Vendor
Product
Version
CVE
Patched?
ONLYOFFICE
Workspace
12.1.0.1760
CVE-2022-47412
Unpatched
OpenKM
OpenKM
6.3.12
CVE-2022-47413
Unpatched
OpenKM
OpenKM
6.3.12
CVE-2022-47414
Unpatched
LogicalDOC
LogicalDOC CE/Enterprise
8.7.3/8.8.2
CVE-2022-47415
Unpatched
LogicalDOC
LogicalDOC CE/Enterprise
8.7.3/8.8.2
CVE-2022-47416
Unpatched
LogicalDOC
LogicalDOC CE/Enterprise
8.7.3/8.8.2
CVE-2022-47417
Unpatched
LogicalDOC
LogicalDOC CE/Enterprise
8.7.3/8.8.2
CVE-2022-47418
Unpatched
Mayan
Mayan EDMS
4.3.3
CVE-2022-47419
Unpatched
All of these issues were discovered by Rapid7 researcher Matthew Kienow, and validated by Rapid7's security sciences team. Unfortunately, none of these vendors were able to respond to Rapid7's disclosure outreach, despite having coordinated these disclosures with CERT/CC. As such, these issues are being disclosed in accordance with Rapid7's multiple 47412 through 20222 47419
){kind=link}