CVE-2020-29072 - A Cross-Site Script Inclusion vulnerability was found on LiquidFiles before 3.3.19

Back Back to CVE browser

MEDIUM

A Cross-Site Script Inclusion vulnerability was found on LiquidFiles before 3.3.19

Published Nov 25, 2020

6.1

MEDIUM

CVSS 3.1

EPSS 0.71%

Description

A Cross-Site Script Inclusion vulnerability was found on LiquidFiles before 3.3.19. This client-side attack requires user interaction (opening a link) and successful exploitation could lead to encrypted e-mail content leakage via messages/sent?format=js and popup?format=js.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-829

References (3)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-21454
Advisory
https://lean0x2f.github.io/liquidfiles_advisory
x_refsource_MISCExploitThird Party Advisory
https://man.liquidfiles.com/release_notes/version_3-3-x.html
x_refsource_MISCRelease NotesVendor Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-21454		Advisory
https://lean0x2f.github.io/liquidfiles_advisory		x_refsource_MISCExploitThird Party Advisory
https://man.liquidfiles.com/release_notes/version_3-3-x.html		x_refsource_MISCRelease NotesVendor Advisory