Vulnerability · Published Apr 6, 2021 · Assigned by mitre

CVE-2021-30140

Medium 5.4

In plain English

A medium-severity security flaw in the affected software. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.4% (higher than 72% of all known vulnerabilities).

Severity (CVSS 3.1)5.4Medium

Exploit odds (30 days)1.4%top 28.1% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

LiquidFiles 3.4.15 has stored XSS through the "send email" functionality when sending a file via email to an administrator. When a file has no extension and contains malicious HTML / JavaScript content (such as SVG with HTML content), the payload is executed upon a click. This is fixed in 3.5.

Affected products (as reported)

Vendor	Product	Versions
n/a	n/a	n/a

References

https://www.tempest.com.br x_refsource_MISC
https://liquidfiles.com/support.html x_refsource_MISC
https://gist.github.com/rodnt/9f7d368fac38cafa7334598ec94fb167 x_refsource_MISC
20220518 LiquidFiles - 3.4.15 - Stored XSS - CVE-2021-30140 mailing-list, x_refsource_FULLDISC
http://packetstormsecurity.com/files/167228/LiquidFiles-3.4.15-Cross-Site-Scripting.html x_refsource_MISC