GHSA-hwp2-gvm5-452f
Liferay Portal Allows Cross-Site Scripting (XSS) via the SimpleCaptcha API
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Maven | com.liferay.portal:release.portal.bom | < 7.1.0 | 7.1.0 |
Details
As written in the advisory (Markdown source, shown as plain text).
In Liferay Portal before 7.1 CE GA4, an XSS vulnerability exists in the SimpleCaptcha API when custom code passes unsanitized input into the "url" parameter of the JSP taglib call <liferay-ui:captcha url="<%= url %>" /> or <liferay-captcha:captcha url="<%= url %>" />. Liferay Portal out-of-the-box behavior with no customizations is not vulnerable.
References
External links from the advisory. They lead to third-party sites.
- https://nvd.nist.gov/vuln/detail/CVE-2019-6588
- https://dev.liferay.com/web/community-security-team/known-vulnerabilities/liferay-portal-71/-/asset_publisher/7v4O7y85hZMo/content/cst-7130-…
- https://github.com/liferay/liferay-portal
- http://packetstormsecurity.com/files/153252/Liferay-Portal-7.1-CE-GA4-Cross-Site-Scripting.html