Description

XSS exists in Liferay Portal before 7.0 CE GA4 via a crafted title or summary that is mishandled in the Web Content Display.

Remediation

References

https://dev.liferay.com/web/community-security-team/known-vulnerabilities/liferay-portal-70/-/asset_publisher/cjE0ourZXJZE/content/cst-7017-multiple-xss-vulnerabilities

https://github.com/brianchandotcom/liferay-portal/pull/47579

Related Vulnerabilities

CVE-2023-3894 Vulnerability in maven package com.fasterxml.jackson.dataformat:jackson-dataformat-properties

CVE-2021-41184 Vulnerability in maven package org.webjars:jquery-ui

CVE-2019-3580 Vulnerability in maven package org.openrefine:openrefine

CVE-2022-23532 Vulnerability in maven package org.neo4j.procedure:apoc

CVE-2021-21429 Vulnerability in maven package org.openapitools:openapi-generator-maven-plugin

Severity

High

Classification

CWE-79 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Tags

Issue Tracking Patch Vendor Advisory Third Party Advisory