CVE-2020-29071 - CVE House
Back to Database
Status published Critical CVE-2020-29071

An XSS issue was found in the Shares feature of...

Vulnerability Description

An XSS issue was found in the Shares feature of LiquidFiles before 3.3.19. The issue arises from the insecure rendering of HTML files uploaded to the platform as attachments, when the -htmlview URL is directly accessed. The impact ranges from executing commands as root on the server to retrieving sensitive information about encrypted e-mails, depending on the permissions of the target user.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2020-29071

Credits & Attribution

No credits recorded in the NVD database.

References

More from liquidfiles

View All →
CVE-2021-43397
LiquidFiles before 3.6.3 allows remote attackers to elevate their privileges...
High 8.8
CVE-2021-30140
LiquidFiles 3.4.15 has stored XSS through the "send email" functionality...
Medium 5.4
CVE-2020-29072
A Cross-Site Script Inclusion vulnerability was found on LiquidFiles before...
Medium 6.1

Affected Vendor

liquidfiles

View all reports →

Affected Software

liquidfiles
Vulnerable Versions:
0

Timeline

Official Publish: November 25th, 2020
Last Modified: August 4th, 2024
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.