CVE-2025-56132
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-09-30

Last updated on: 2025-10-15

Assigner: MITRE

Description
LiquidFiles filetransfer server is vulnerable to a user enumeration issue in its password reset functionality. The application returns distinguishable responses for valid and invalid email addresses, allowing unauthenticated attackers to determine the existence of user accounts. Version 4.2 introduces user-based lockout mechanisms to mitigate brute-force attacks, user enumeration remains possible by default. In versions prior to 4.2, no such user-level protection is in place, only basic IP-based rate limiting is enforced. This IP-based protection can be bypassed by distributing requests across multiple IPs (e.g., rotating IP or proxies). Effectively bypassing both login and password reset security controls. Successful exploitation allows an attacker to enumerate valid email addresses registered for the application, increasing the risk of follow-up attacks such as password spraying.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-09-30
Last Modified
2025-10-15
Generated
2026-05-07
AI Q&A
2025-09-30
EPSS Evaluated
2026-05-05
NVD
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
liquidfiles liquidfiles to 4.2.0 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-305 The authentication algorithm is sound, but the implemented mechanism can be bypassed as the result of a separate weakness that is primary to the authentication error.
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?

This vulnerability in LiquidFiles filetransfer server allows unauthenticated attackers to perform user enumeration through the password reset functionality. The application responds differently to valid and invalid email addresses, enabling attackers to determine which email addresses are registered users. Although version 4.2 introduces user-based lockout mechanisms to reduce brute-force attacks, user enumeration is still possible by default. Earlier versions rely only on IP-based rate limiting, which can be bypassed by using multiple IP addresses.


How can this vulnerability impact me? :

The vulnerability allows attackers to identify valid user email addresses registered in the system. This information can be used to launch follow-up attacks such as password spraying, increasing the risk of unauthorized access to user accounts and potentially compromising sensitive data.


What immediate steps should I take to mitigate this vulnerability?

To mitigate this vulnerability, upgrade LiquidFiles filetransfer server to version 4.2 or later, which introduces user-based lockout mechanisms to reduce brute-force attacks. Additionally, monitor and limit password reset requests to prevent abuse, and consider implementing additional protections such as CAPTCHA or multi-factor authentication to reduce the risk of user enumeration and follow-up attacks.


Ask Our AI Assistant
Need more information? Ask your question to get an AI reply (Powered by our expertise)
0/70
EPSS Chart