CVE-2024-12020 Reflected Cross-Site Scripting (XSS)

Medium 6.4 Published 14 Mar 2025 Updated 18 Mar 2025

An unauthenticated attacker can execute scripts in a victim's browser via a crafted link, inducing unauthorized on-site actions.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2024-12020?

CVE-2024-12020 is a medium-severity cross-site scripting vulnerability in LogicalDOC Enterprise, published on 14 Mar 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

There is a reflected cross-site scripting (XSS) within JSP files used to control application appearance. An unauthenticated attacker could deceive a user into clicking a crafted link to trigger the vulnerability. Stealing the session cookie is not possible due to cookie security flags, however the XSS may be used to induce a victim to perform on-site requests without their knowledge.

This vulnerability only affects LogicalDOC Enterprise.

Weakness: CWE-79

Which versions are affected by CVE-2024-12020?

It affects 1 product.

Products include Logicaldoc Logicaldoc.

How do I fix CVE-2024-12020?

No fix has been published for CVE-2024-12020 yet. Limit exposure of the affected software until one is available.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2024-12020 being exploited?

There is no known exploitation of CVE-2024-12020 in the wild and no public exploit code.

Sources

Also known as GHSA-x3gq-h244-25jf.