PT-2021-18627 · Unknown · Liquidfiles

Rodolfo Augusto Do Nascimento Tavares · Published 2021-04-06 · Updated 2022-09-30 · CVE-2021-30140

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions LiquidFiles versions 3.4.15

Description The issue is related to stored XSS through the "send email" functionality when sending a file via email to an administrator. When a file has no extension and contains malicious HTML/JavaScript content, such as SVG with HTML content, the payload is executed upon a click.

Recommendations For LiquidFiles version 3.4.15, update to version 3.5 to resolve the issue. As a temporary workaround, consider restricting the "send email" functionality to prevent potential exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-30140

Affected Products

Liquidfiles

References · 9

• 🔥 http://seclists.org/fulldisclosure/2022/May/41 · Exploit
• 🔥 http://packetstormsecurity.com/files/167228/LiquidFiles-3.4.15-Cross-Site-Scripting.html · Exploit
• 🔥 https://gist.github.com/rodnt/9f7d368fac38cafa7334598ec94fb167 · Exploit
• https://liquidfiles.com/support.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-30140 · Security Note
• https://osv.dev/vulnerability/CVE-2021-30140 · Vendor Advisory
• https://t.me/cvenotify/30462 · Telegram Post
• https://tempest.com.br · Note
• https://t.me/cvenotify/12761 · Telegram Post