~ / search / GHSA-7m65-hmvg-rxpc

GHSA-7m65-hmvg-rxpc

Liferay Portal and Liferay DXP Vulnerable to XSS in the Site Module

Source: GitHub Advisory Database (reviewed) Moderate CVE-2022-28978

Packages

EcosystemPackageAffectedFixed in
Maven com.liferay:com.liferay.site.memberships.web < 5.0.10 5.0.10
Maven com.liferay.portal:release.dxp.bom >= 7.0.0, < 7.0.10.fp102 7.0.10.fp102
Maven com.liferay.portal:release.dxp.bom >= 7.1.0, < 7.1.10.fp26 7.1.10.fp26
Maven com.liferay.portal:release.dxp.bom >= 7.2.0, < 7.2.10.fp15 7.2.10.fp15

Details

As written in the advisory (Markdown source, shown as plain text).

Stored cross-site scripting (XSS) vulnerability in the Site module's user membership administration page in Liferay Site Memberships Web before 5.0.10 from Liferay Portal (7.0.1 through 7.4.1), and Liferay DXP 7.0 before fix pack 102, 7.1 before fix pack 26, 7.2 before fix pack 15, and 7.3 before service pack 3 allows remote attackers to inject arbitrary web script or HTML via the a user's name.

References

External links from the advisory. They lead to third-party sites.