Description
A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.3, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12 and 7.4 GA through update 92 allows an remote non-authenticated attacker to inject JavaScript into the referer or FORWARD_URL using %00 in those parameters.
Remediation
References
Related Vulnerabilities
WordPress Plugin Blunt GA Cross-Site Scripting (4.0.0)
WordPress Plugin LearnPress-WordPress LMS Local File Inclusion (4.2.6.8.2)
phpBB Improper Control of Generation of Code ('Code Injection') Vulnerability (CVE-2007-5173)
WordPress Plugin Recipe Card Blocks for Gutenberg & Elementor Cross-Site Scripting (2.8.2)
Drupal Core 5.x Multiple Cross-Site Scripting Vulnerabilities (5.0 - 5.1)