LogicalDOC Enterprise Reflected Cross-Site Scripting Vulnerability

A reflected cross-site scripting vulnerability has been identified in LogicalDOC Enterprise Edition, specifically within JSP files that control the application's appearance. This vulnerability allows an unauthenticated attacker to trick a user into clicking a crafted link, potentially leading to unauthorized actions being performed on the user's behalf. While the vulnerability does not allow for session cookie theft due to cookie security flags, it could be exploited to manipulate a victim into making on-site requests without their knowledge.

Impact

Exploitation of this vulnerability could result in a user unknowingly performing actions on the site, potentially leading to further exploitation or manipulation within the application.