CVE-2020-29071
Critical
Description
An XSS issue was found in the Shares feature of LiquidFiles before 3.3.19. The issue arises from the insecure rendering of HTML files uploaded to the platform as attachments, when the -htmlview URL is directly accessed. The impact ranges from executing commands as root on the server to retrieving sensitive information about encrypted e-mails, depending on the permissions of the target user.
SeverityCritical
CVSS9.0
Exploit probability—
ProductLiquidfiles
PublishedNov 25, 2020
First seenNov 25, 2020
How to fix
Update
- liquidfiles liquidfiles3.3.19 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| liquidfiles liquidfiles | v < 3.3.19 | 3.3.19 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.