Cross-Site Script Inclusion Vulnerability in LiquidFiles by LiquidFiles
CVE-2020-29072

6.1MEDIUM

Key Information:

Vendor

Liquidfiles

Status
Liquidfiles
Vendor
CVE Published:
25 November 2020

What is CVE-2020-29072?

A Cross-Site Script Inclusion vulnerability exists in LiquidFiles versions before 3.3.19, enabling attackers to exploit the vulnerability through user interaction. When a user opens a specially crafted link, it can lead to the unintentional leakage of encrypted email content. This occurs via messages/sent?format=js and popup?format=js, exposing sensitive information to attackers and posing significant security risks.

References

https://lean0x2f.github.io/liquidfiles_advisory
x_refsource_MISC
https://man.liquidfiles.com/release_notes/version_3-3-x.html
x_refsource_MISC

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.