A critical information disclosure vulnerability in LiquidFiles filetransfer allows unauthenticated attackers to enumerate valid user accounts, facilitating targeted phishing and credential-based attacks.

The application returns distinguishable responses for valid versus invalid email addresses during password reset requests. An unauthenticated attacker can leverage these discrepancies to confirm the existence of registered users, bypassing standard rate-limiting protections through distributed request patterns.

This vulnerability poses a significant risk to organizational security by enabling attackers to build a directory of valid user accounts. With this information, adversaries can launch highly targeted password spraying or social engineering campaigns. While the CVSS score of 7.3 reflects a moderate severity, the ability to map the user base significantly lowers the barrier for future unauthorized access attempts, potentially leading to a broader breach of sensitive file transfer data.

Immediate Action: Upgrade LiquidFiles filetransfer to version 4.2 or later to implement enhanced user-based lockout mechanisms.

Proactive Monitoring: Review application access logs for high-frequency password reset requests or anomalous patterns originating from multiple IP addresses.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rate-limiting rules configured to detect and block abnormal request volumes directed at authentication and password reset endpoints.

Public Exploit Available: No (detection templates exist via Nuclei, but no weaponized exploit is confirmed).

Organizations utilizing LiquidFiles must prioritize upgrading to version 4.2 immediately to mitigate the risk of account enumeration. Failure to address this vulnerability allows attackers to conduct reconnaissance that directly supports more severe follow-up attacks. Ensure that security teams monitor for patterns indicative of automated enumeration to identify potential targeting of your infrastructure.