CVE-2020-29071

An XSS issue was found in the Shares feature of LiquidFiles before 3.3.19. The issue arises from the insecure rendering of HTML files uploaded to the platform as attachments, when the -htmlview URL is directly accessed. The impact ranges from executing commands as root on the server to retrieving sensitive information about encrypted e-mails, depending on the permissions of the target user.

CVSS v3 9.0 CRITICAL
CVSS v2.0 8.5 HIGH

9.0^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 2.3 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

8.5^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:M/Au:S/C:C/I:C/A:C

Exploitability : 6.8 / Impact : 10.0

Access Vector NETWORK

Access Complexity MEDIUM

Authentication SINGLE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
https://lean0x2f.github.io/liquidfiles_advisory	Exploit Third Party Advisory
https://man.liquidfiles.com/release_notes/version_3-3-x.html	Release Notes Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:liquidfiles:liquidfiles:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2020-11-25 03:15

Updated : 2024-02-04 21:23

NVD link : CVE-2020-29071

Mitre link : CVE-2020-29071

CVE.ORG link : CVE-2020-29071

JSON object : View

Products Affected

liquidfiles

liquidfiles

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2020-29071", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 8.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:S/C:C/I:C/A:C", "authentication": "SINGLE", "integrityImpact": "COMPLETE", "accessComplexity": "MEDIUM", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 6.8, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.0, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 2.3}]}, "published": "2020-11-25T03:15:11.033", "references": [{"url": "https://lean0x2f.github.io/liquidfiles_advisory", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://man.liquidfiles.com/release_notes/version_3-3-x.html", "tags": ["Release Notes", "Vendor Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "An XSS issue was found in the Shares feature of LiquidFiles before 3.3.19. The issue arises from the insecure rendering of HTML files uploaded to the platform as attachments, when the -htmlview URL is directly accessed. The impact ranges from executing commands as root on the server to retrieving sensitive information about encrypted e-mails, depending on the permissions of the target user."}, {"lang": "es", "value": "Se encontr\u00f3 un problema de tipo XSS en la funcionalidad Shares de LiquidFiles versiones anteriores a 3.3.19. El problema surge de la renderizaci\u00f3n no segura de archivos HTML cargados en la plataforma como archivos adjuntos, cuando se accede directamente a la URL -htmlview. El impacto var\u00eda desde una ejecuci\u00f3n de comandos como root en el servidor hasta una recuperaci\u00f3n de informaci\u00f3n confidencial sobre correos electr\u00f3nicos cifrados, dependiendo de los permisos del usuario objetivo"}], "lastModified": "2020-12-02T16:30:46.120", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:liquidfiles:liquidfiles:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "31C07169-3808-459A-94C5-E64629071CC9", "versionEndExcluding": "3.3.19"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}