Skip to main content

Liquidfiles CVE-2020-29072

MEDIUM
Inclusion of Functionality from Untrusted Control Sphere (CWE-829)
2020-11-25 cve@mitre.org
Information Disclosure Liquidfiles
6.1
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
6.1 MEDIUM
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
None

Lifecycle Timeline

1
CVE Published
Nov 25, 2020 - 03:15 nvd
MEDIUM 6.1

DescriptionNVD

A Cross-Site Script Inclusion vulnerability was found on LiquidFiles before 3.3.19. This client-side attack requires user interaction (opening a link) and successful exploitation could lead to encrypted e-mail content leakage via messages/sent?format=js and popup?format=js.

AnalysisAI

A Cross-Site Script Inclusion vulnerability was found on LiquidFiles before 3.3.19. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-829. A Cross-Site Script Inclusion vulnerability was found on LiquidFiles before 3.3.19. This client-side attack requires user interaction (opening a link) and successful exploitation could lead to encrypted e-mail content leakage via messages/sent?format=js and popup?format=js. Affected products include: Liquidfiles. Version information: before 3.3.19..

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Liquidfiles

View all
CVE-2020-29071 CRITICAL POC
9.0 Nov 25

An XSS issue was found in the Shares feature of LiquidFiles before 3.3.19. Rated critical severity (CVSS 9.0), this vuln
CVE-2021-43397 HIGH POC
8.8 Nov 11

LiquidFiles before 3.6.3 allows remote attackers to elevate their privileges from Admin (or User Admin) to Sysadmin. Rat
CVE-2025-56132 HIGH POC
7.3 Sep 30

LiquidFiles filetransfer server is vulnerable to a user enumeration issue in its password reset functionality. Rated hig
CVE-2026-12673 MEDIUM POC
5.9 Jun 20

Privilege escalation in LiquidFiles before 4.2.12 allows an authenticated Admin of a secondary (non-default) domain to e
CVE-2021-30140 MEDIUM POC
5.4 Apr 06

LiquidFiles 3.4.15 has stored XSS through the "send email" functionality when sending a file via email to an administrat
CVE-2023-4393 MEDIUM
6.1 Oct 30

HTML and SMTP injections on the registration page of LiquidFiles versions 3.7.13 and below, allow an attacker to perform
CVE-2025-46094 LOW POC
3.8 Aug 04

LiquidFiles before 4.1.2 allows directory traversal by configuring the pathname of a local executable file as an Actions
CVE-2025-46093 CRITICAL POC
9.9 Aug 04

LiquidFiles before 4.1.2 supports FTP SITE CHMOD for mode 6777 (setuid and setgid), which allows FTPDrop users to execut

Same weakness CWE-829 – Inclusion of Functionality from Untrusted Control Sphere

View all
CVE-2025-32463 CRITICAL POC
9.3
CVE-2026-0770 CRITICAL POC
9.8
CVE-2025-27607 HIGH POC
8.8
CVE-2026-1699 CRITICAL POC
10.0
CVE-2026-27941 CRITICAL POC
9.9
CVE-2020-8128 CRITICAL POC
9.8
CVE-2019-13589 CRITICAL POC
9.8
CVE-2018-15486 CRITICAL POC
9.1

Same technique Information Disclosure

View all
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8
CVE-2023-7028 CRITICAL POC
10.0
CVE-2017-0213 HIGH POC
7.3

Share

CVE-2020-29072 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy