Vulnerabilites related to Liferay - DXP
cve-2024-25606
Vulnerability from cvelistv5
Published
2024-02-20 09:03
Modified
2024-08-01 23:44
Severity ?
EPSS score ?
Summary
XXE vulnerability in Liferay Portal 7.2.0 through 7.4.3.7, and older unsupported versions, and Liferay DXP 7.4 before update 4, 7.3 before update 12, 7.2 before fix pack 20, and older unsupported versions allows attackers with permission to deploy widgets/portlets/extensions to obtain sensitive information or consume system resources via the Java2WsddTask._format method.
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-25606",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-02-20T13:32:40.505546Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-07-05T17:20:56.428Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-01T23:44:09.795Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25606"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Portal",
"vendor": "Liferay",
"versions": [
{
"lessThanOrEqual": "7.4.3.7",
"status": "affected",
"version": "7.2.0",
"versionType": "maven"
}
]
},
{
"defaultStatus": "unknown",
"product": "DXP",
"vendor": "Liferay",
"versions": [
{
"lessThanOrEqual": "7.4.13.u3",
"status": "affected",
"version": "7.4.13",
"versionType": "maven"
},
{
"lessThanOrEqual": "7.3.10.u11",
"status": "affected",
"version": "7.3.10",
"versionType": "maven"
},
{
"lessThanOrEqual": "7.2.10-dxp-19",
"status": "affected",
"version": "7.2.10",
"versionType": "maven"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "XXE vulnerability in Liferay Portal 7.2.0 through 7.4.3.7, and older unsupported versions, and Liferay DXP 7.4 before update 4, 7.3 before update 12, 7.2 before fix pack 20, and older unsupported versions allows attackers with permission to deploy widgets/portlets/extensions to obtain sensitive information or consume system resources via the Java2WsddTask._format method."
}
],
"value": "XXE vulnerability in Liferay Portal 7.2.0 through 7.4.3.7, and older unsupported versions, and Liferay DXP 7.4 before update 4, 7.3 before update 12, 7.2 before fix pack 20, and older unsupported versions allows attackers with permission to deploy widgets/portlets/extensions to obtain sensitive information or consume system resources via the Java2WsddTask._format method."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-611",
"description": "CWE-611 Improper Restriction of XML External Entity Reference",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-02-20T09:03:19.221Z",
"orgId": "8b54e794-c6f0-462e-9faa-c1001a673ac3",
"shortName": "Liferay"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25606"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "8b54e794-c6f0-462e-9faa-c1001a673ac3",
"assignerShortName": "Liferay",
"cveId": "CVE-2024-25606",
"datePublished": "2024-02-20T09:03:19.221Z",
"dateReserved": "2024-02-08T13:57:11.425Z",
"dateUpdated": "2024-08-01T23:44:09.795Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2024-26267
Vulnerability from cvelistv5
Published
2024-02-20 13:01
Modified
2024-08-02 00:07
Severity ?
EPSS score ?
Summary
In Liferay Portal 7.2.0 through 7.4.3.25, and older unsupported versions, and Liferay DXP 7.4 before update 26, 7.3 before update 5, 7.2 before fix pack 19, and older unsupported versions the default value of the portal property `http.header.version.verbosity` is set to `full`, which allows remote attackers to easily identify the version of the application that is running and the vulnerabilities that affect that version via 'Liferay-Portal` response header.
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-26267",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-02-21T15:20:52.766968Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-04T17:49:00.661Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T00:07:17.897Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-26267"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Portal",
"vendor": "Liferay",
"versions": [
{
"lessThanOrEqual": "7.4.3.25",
"status": "affected",
"version": "7.2.0",
"versionType": "maven"
}
]
},
{
"defaultStatus": "unknown",
"product": "DXP",
"vendor": "Liferay",
"versions": [
{
"lessThanOrEqual": "7.4.13.u25",
"status": "affected",
"version": "7.4.13",
"versionType": "maven"
},
{
"lessThanOrEqual": "7.3.10.u4",
"status": "affected",
"version": "7.3.10",
"versionType": "maven"
},
{
"lessThanOrEqual": "7.2.10-dxp-18",
"status": "affected",
"version": "7.2.10",
"versionType": "maven"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "In Liferay Portal 7.2.0 through 7.4.3.25, and older unsupported versions, and Liferay DXP 7.4 before update 26, 7.3 before update 5, 7.2 before fix pack 19, and older unsupported versions the default value of the portal property `http.header.version.verbosity` is set to `full`, which allows remote attackers to easily identify the version of the application that is running and the vulnerabilities that affect that version via \u0027Liferay-Portal` response header."
}
],
"value": "In Liferay Portal 7.2.0 through 7.4.3.25, and older unsupported versions, and Liferay DXP 7.4 before update 26, 7.3 before update 5, 7.2 before fix pack 19, and older unsupported versions the default value of the portal property `http.header.version.verbosity` is set to `full`, which allows remote attackers to easily identify the version of the application that is running and the vulnerabilities that affect that version via \u0027Liferay-Portal` response header."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1188",
"description": "CWE-1188 Insecure Default Initialization of Resource",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-02-20T13:02:05.832Z",
"orgId": "8b54e794-c6f0-462e-9faa-c1001a673ac3",
"shortName": "Liferay"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-26267"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "8b54e794-c6f0-462e-9faa-c1001a673ac3",
"assignerShortName": "Liferay",
"cveId": "CVE-2024-26267",
"datePublished": "2024-02-20T13:01:23.251Z",
"dateReserved": "2024-02-15T07:44:36.776Z",
"dateUpdated": "2024-08-02T00:07:17.897Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2024-25604
Vulnerability from cvelistv5
Published
2024-02-20 08:40
Modified
2024-08-01 23:44
Severity ?
EPSS score ?
Summary
Liferay Portal 7.2.0 through 7.4.3.4, and older unsupported versions, and Liferay DXP 7.4.13, 7.3 before service pack 3, 7.2 before fix pack 17, and older unsupported versions does not properly check user permissions, which allows remote authenticated users with the VIEW user permission to edit their own permission via the User and Organizations section of the Control Panel.
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-25604",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-02-21T18:38:45.740772Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-04T17:35:25.137Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-01T23:44:09.655Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25604"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Portal",
"vendor": "Liferay",
"versions": [
{
"lessThanOrEqual": "7.4.3.4",
"status": "affected",
"version": "7.2.0",
"versionType": "maven"
}
]
},
{
"defaultStatus": "unknown",
"product": "DXP",
"vendor": "Liferay",
"versions": [
{
"status": "affected",
"version": "7.4.13"
},
{
"lessThanOrEqual": "7.3.10-dxp-2",
"status": "affected",
"version": "7.3.10",
"versionType": "maven"
},
{
"lessThanOrEqual": "7.2.10-dxp-16",
"status": "affected",
"version": "7.2.10",
"versionType": "maven"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Liferay Portal 7.2.0 through 7.4.3.4, and older unsupported versions, and Liferay DXP 7.4.13, 7.3 before service pack 3, 7.2 before fix pack 17, and older unsupported versions does not properly check user permissions, which allows remote authenticated users with the VIEW user permission to edit their own permission via the User and Organizations section of the Control Panel."
}
],
"value": "Liferay Portal 7.2.0 through 7.4.3.4, and older unsupported versions, and Liferay DXP 7.4.13, 7.3 before service pack 3, 7.2 before fix pack 17, and older unsupported versions does not properly check user permissions, which allows remote authenticated users with the VIEW user permission to edit their own permission via the User and Organizations section of the Control Panel."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863 Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-02-20T08:40:59.252Z",
"orgId": "8b54e794-c6f0-462e-9faa-c1001a673ac3",
"shortName": "Liferay"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25604"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "8b54e794-c6f0-462e-9faa-c1001a673ac3",
"assignerShortName": "Liferay",
"cveId": "CVE-2024-25604",
"datePublished": "2024-02-20T08:40:59.252Z",
"dateReserved": "2024-02-08T13:57:11.425Z",
"dateUpdated": "2024-08-01T23:44:09.655Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2023-33950
Vulnerability from cvelistv5
Published
2023-05-24 16:10
Modified
2024-10-22 15:51
Severity ?
EPSS score ?
Summary
Pattern Redirects in Liferay Portal 7.4.3.48 through 7.4.3.76, and Liferay DXP 7.4 update 48 through 76 allows regular expressions that are vulnerable to ReDoS attacks to be used as patterns, which allows remote attackers to consume an excessive amount of server resources via crafted request URLs.
References
Impacted products
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T15:54:13.911Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-33950"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-33950",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-10-22T15:43:43.861695Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-10-22T15:51:22.703Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Portal",
"vendor": "Liferay",
"versions": [
{
"lessThanOrEqual": "7.4.3.76",
"status": "affected",
"version": "7.4.3.48",
"versionType": "maven"
}
]
},
{
"defaultStatus": "unaffected",
"product": "DXP",
"vendor": "Liferay",
"versions": [
{
"lessThanOrEqual": "7.4.13.u76",
"status": "affected",
"version": "7.4.13.u48",
"versionType": "maven"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Pattern Redirects in Liferay Portal 7.4.3.48 through 7.4.3.76, and Liferay DXP 7.4 update 48 through 76 allows regular expressions that are vulnerable to ReDoS attacks to be used as patterns, which allows remote attackers to consume an excessive amount of server resources via crafted request URLs."
}
],
"value": "Pattern Redirects in Liferay Portal 7.4.3.48 through 7.4.3.76, and Liferay DXP 7.4 update 48 through 76 allows regular expressions that are vulnerable to ReDoS attacks to be used as patterns, which allows remote attackers to consume an excessive amount of server resources via crafted request URLs."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1333",
"description": "CWE-1333 Inefficient Regular Expression Complexity",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-05-24T16:10:10.701Z",
"orgId": "8b54e794-c6f0-462e-9faa-c1001a673ac3",
"shortName": "Liferay"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-33950"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "8b54e794-c6f0-462e-9faa-c1001a673ac3",
"assignerShortName": "Liferay",
"cveId": "CVE-2023-33950",
"datePublished": "2023-05-24T16:10:10.701Z",
"dateReserved": "2023-05-24T02:36:00.165Z",
"dateUpdated": "2024-10-22T15:51:22.703Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2023-42498
Vulnerability from cvelistv5
Published
2024-02-21 02:47
Modified
2024-08-02 19:23
Severity ?
EPSS score ?
Summary
Reflected cross-site scripting (XSS) vulnerability in the Language Override edit screen in Liferay Portal 7.4.3.8 through 7.4.3.97, and Liferay DXP 2023.Q3 before patch 5, and 7.4 update 4 through 92 allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_portal_language_override_web_internal_portlet_PLOPortlet_key parameter.
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-42498",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-02-26T17:54:30.386431Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-04T17:25:12.034Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T19:23:39.621Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-42498"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Portal",
"vendor": "Liferay",
"versions": [
{
"lessThanOrEqual": "7.4.3.97",
"status": "affected",
"version": "7.4.3.8",
"versionType": "maven"
}
]
},
{
"defaultStatus": "unaffected",
"product": "DXP",
"vendor": "Liferay",
"versions": [
{
"lessThanOrEqual": "2023.q3.4",
"status": "affected",
"version": "2023.q3.1",
"versionType": "maven"
},
{
"lessThanOrEqual": "7.4.13.u92",
"status": "affected",
"version": "7.4.13.u4",
"versionType": "maven"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"user": "00000000-0000-4000-9000-000000000000",
"value": "Amin ACHOUR"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Reflected cross-site scripting (XSS) vulnerability in the Language Override edit screen in Liferay Portal 7.4.3.8 through 7.4.3.97, and Liferay DXP 2023.Q3 before patch 5, and 7.4 update 4 through 92 allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_portal_language_override_web_internal_portlet_PLOPortlet_key parameter."
}
],
"value": "Reflected cross-site scripting (XSS) vulnerability in the Language Override edit screen in Liferay Portal 7.4.3.8 through 7.4.3.97, and Liferay DXP 2023.Q3 before patch 5, and 7.4 update 4 through 92 allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_portal_language_override_web_internal_portlet_PLOPortlet_key parameter."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.6,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-02-21T02:47:45.261Z",
"orgId": "8b54e794-c6f0-462e-9faa-c1001a673ac3",
"shortName": "Liferay"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-42498"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "8b54e794-c6f0-462e-9faa-c1001a673ac3",
"assignerShortName": "Liferay",
"cveId": "CVE-2023-42498",
"datePublished": "2024-02-21T02:47:45.261Z",
"dateReserved": "2023-09-11T08:54:24.312Z",
"dateUpdated": "2024-08-02T19:23:39.621Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2023-33947
Vulnerability from cvelistv5
Published
2023-05-24 15:34
Modified
2024-10-22 15:51
Severity ?
EPSS score ?
Summary
The Object module in Liferay Portal 7.4.3.4 through 7.4.3.60, and Liferay DXP 7.4 before update 61 does not segment object definition by virtual instance in search which allows remote authenticated users in one virtual instance to view object definition from a second virtual instance by searching for the object definition.
References
Impacted products
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T15:54:13.639Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-33947"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-33947",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-10-22T15:44:18.454627Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-10-22T15:51:45.231Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Portal",
"vendor": "Liferay",
"versions": [
{
"lessThanOrEqual": "7.4.3.60",
"status": "affected",
"version": "7.4.3.4",
"versionType": "maven"
}
]
},
{
"defaultStatus": "unaffected",
"product": "DXP",
"vendor": "Liferay",
"versions": [
{
"lessThanOrEqual": "7.4.13.u60",
"status": "affected",
"version": "7.4.13",
"versionType": "maven"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The Object module in Liferay Portal 7.4.3.4 through 7.4.3.60, and Liferay DXP 7.4 before update 61 does not segment object definition by virtual instance in search which allows remote authenticated users in one virtual instance to view object definition from a second virtual instance by searching for the object definition."
}
],
"value": "The Object module in Liferay Portal 7.4.3.4 through 7.4.3.60, and Liferay DXP 7.4 before update 61 does not segment object definition by virtual instance in search which allows remote authenticated users in one virtual instance to view object definition from a second virtual instance by searching for the object definition."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 2.7,
"baseSeverity": "LOW",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "CWE-284 Improper Access Control",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-05-24T15:34:37.132Z",
"orgId": "8b54e794-c6f0-462e-9faa-c1001a673ac3",
"shortName": "Liferay"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-33947"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "8b54e794-c6f0-462e-9faa-c1001a673ac3",
"assignerShortName": "Liferay",
"cveId": "CVE-2023-33947",
"datePublished": "2023-05-24T15:34:37.132Z",
"dateReserved": "2023-05-24T02:36:00.165Z",
"dateUpdated": "2024-10-22T15:51:45.231Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2023-42627
Vulnerability from cvelistv5
Published
2023-10-17 12:08
Modified
2024-08-02 19:23
Severity ?
EPSS score ?
Summary
Multiple stored cross-site scripting (XSS) vulnerabilities in the Commerce module in Liferay Portal 7.3.5 through 7.4.3.91, and Liferay DXP 7.3 update 33 and earlier, and 7.4 before update 92 allow remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a (1) Shipping Name, (2) Shipping Phone Number, (3) Shipping Address, (4) Shipping Address 2, (5) Shipping Address 3, (6) Shipping Zip, (7) Shipping City, (8) Shipping Region (9), Shipping Country, (10) Billing Name, (11) Billing Phone Number, (12) Billing Address, (13) Billing Address 2, (14) Billing Address 3, (15) Billing Zip, (16) Billing City, (17) Billing Region, (18) Billing Country, or (19) Region Code.
References
| ▼ | URL | Tags |
|---|---|---|
| https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-42627 | vendor-advisory | |
| https://www.pentagrid.ch/en/blog/stored-cross-site-scripting-vulnerabilities-in-liferay-portal/ | third-party-advisory, exploit |
Impacted products
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T19:23:39.907Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-42627"
},
{
"tags": [
"third-party-advisory",
"exploit",
"x_transferred"
],
"url": "https://www.pentagrid.ch/en/blog/stored-cross-site-scripting-vulnerabilities-in-liferay-portal/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "DXP",
"vendor": "Liferay",
"versions": [
{
"lessThanOrEqual": "7.3.10.*",
"status": "affected",
"version": "7.3.10",
"versionType": "maven"
},
{
"lessThanOrEqual": "7.4.13.u91",
"status": "affected",
"version": "7.4.13",
"versionType": "maven"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Portal",
"vendor": "Liferay",
"versions": [
{
"lessThanOrEqual": "7.4.3.91",
"status": "affected",
"version": "7.3.5",
"versionType": "maven"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"user": "00000000-0000-4000-9000-000000000000",
"value": "Michael Oelke"
}
],
"datePublic": "2023-10-17T12:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Multiple stored cross-site scripting (XSS) vulnerabilities in the Commerce module in Liferay Portal 7.3.5 through 7.4.3.91, and Liferay DXP 7.3 update 33 and earlier, and 7.4 before update 92 allow remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a (1) Shipping Name, (2) Shipping Phone Number, (3) Shipping Address, (4) Shipping Address 2, (5) Shipping Address 3, (6) Shipping Zip, (7) Shipping City, (8) Shipping Region (9), Shipping Country, (10) Billing Name, (11) Billing Phone Number, (12) Billing Address, (13) Billing Address 2, (14) Billing Address 3, (15) Billing Zip, (16) Billing City, (17) Billing Region, (18) Billing Country, or (19) Region Code."
}
],
"value": "Multiple stored cross-site scripting (XSS) vulnerabilities in the Commerce module in Liferay Portal 7.3.5 through 7.4.3.91, and Liferay DXP 7.3 update 33 and earlier, and 7.4 before update 92 allow remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a (1) Shipping Name, (2) Shipping Phone Number, (3) Shipping Address, (4) Shipping Address 2, (5) Shipping Address 3, (6) Shipping Zip, (7) Shipping City, (8) Shipping Region (9), Shipping Country, (10) Billing Name, (11) Billing Phone Number, (12) Billing Address, (13) Billing Address 2, (14) Billing Address 3, (15) Billing Zip, (16) Billing City, (17) Billing Region, (18) Billing Country, or (19) Region Code."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.6,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-11-10T02:28:51.923Z",
"orgId": "8b54e794-c6f0-462e-9faa-c1001a673ac3",
"shortName": "Liferay"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-42627"
},
{
"tags": [
"third-party-advisory",
"exploit"
],
"url": "https://www.pentagrid.ch/en/blog/stored-cross-site-scripting-vulnerabilities-in-liferay-portal/"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "8b54e794-c6f0-462e-9faa-c1001a673ac3",
"assignerShortName": "Liferay",
"cveId": "CVE-2023-42627",
"datePublished": "2023-10-17T12:08:22.684Z",
"dateReserved": "2023-09-12T05:35:42.826Z",
"dateUpdated": "2024-08-02T19:23:39.907Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2021-29045
Vulnerability from cvelistv5
Published
2021-05-17 10:22
Modified
2024-08-03 21:55
Severity ?
EPSS score ?
Summary
Cross-site scripting (XSS) vulnerability in the Redirect module's redirection administration page in Liferay Portal 7.3.2 through 7.3.5, and Liferay DXP 7.3 before fix pack 1 allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_redirect_web_internal_portlet_RedirectPortlet_destinationURL parameter.
References
| ▼ | URL | Tags |
|---|---|---|
| http://liferay.com | x_refsource_MISC | |
| https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120743484 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T21:55:12.509Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://liferay.com"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120743484"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in the Redirect module\u0027s redirection administration page in Liferay Portal 7.3.2 through 7.3.5, and Liferay DXP 7.3 before fix pack 1 allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_redirect_web_internal_portlet_RedirectPortlet_destinationURL parameter."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-05-17T10:22:30",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "http://liferay.com"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120743484"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2021-29045",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in the Redirect module\u0027s redirection administration page in Liferay Portal 7.3.2 through 7.3.5, and Liferay DXP 7.3 before fix pack 1 allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_redirect_web_internal_portlet_RedirectPortlet_destinationURL parameter."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://liferay.com",
"refsource": "MISC",
"url": "http://liferay.com"
},
{
"name": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120743484",
"refsource": "MISC",
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120743484"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2021-29045",
"datePublished": "2021-05-17T10:22:30",
"dateReserved": "2021-03-22T00:00:00",
"dateUpdated": "2024-08-03T21:55:12.509Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2023-33948
Vulnerability from cvelistv5
Published
2023-05-24 15:42
Modified
2024-10-22 15:51
Severity ?
EPSS score ?
Summary
The Dynamic Data Mapping module in Liferay Portal 7.4.3.67, and Liferay DXP 7.4 update 67 does not limit Document and Media files which can be downloaded from a Form, which allows remote attackers to download any file from Document and Media via a crafted URL.
References
Impacted products
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T15:54:13.907Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-33948"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-33948",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-10-22T15:48:49.413660Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-10-22T15:51:37.861Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Portal",
"vendor": "Liferay",
"versions": [
{
"status": "affected",
"version": "7.4.3.67"
}
]
},
{
"defaultStatus": "unaffected",
"product": "DXP",
"vendor": "Liferay",
"versions": [
{
"status": "affected",
"version": "7.4.13.u67"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The Dynamic Data Mapping module in Liferay Portal 7.4.3.67, and Liferay DXP 7.4 update 67 does not limit Document and Media files which can be downloaded from a Form, which allows remote attackers to download any file from Document and Media via a crafted URL."
}
],
"value": "The Dynamic Data Mapping module in Liferay Portal 7.4.3.67, and Liferay DXP 7.4 update 67 does not limit Document and Media files which can be downloaded from a Form, which allows remote attackers to download any file from Document and Media via a crafted URL."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-05-24T15:42:39.906Z",
"orgId": "8b54e794-c6f0-462e-9faa-c1001a673ac3",
"shortName": "Liferay"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-33948"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "8b54e794-c6f0-462e-9faa-c1001a673ac3",
"assignerShortName": "Liferay",
"cveId": "CVE-2023-33948",
"datePublished": "2023-05-24T15:42:39.906Z",
"dateReserved": "2023-05-24T02:36:00.165Z",
"dateUpdated": "2024-10-22T15:51:37.861Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2021-33332
Vulnerability from cvelistv5
Published
2021-08-03 20:58
Modified
2024-08-03 23:50
Severity ?
EPSS score ?
Summary
Cross-site scripting (XSS) vulnerability in the Portlet Configuration module in Liferay Portal 7.1.0 through 7.3.2, and Liferay DXP 7.1 before fix pack 19, and 7.2 before fix pack 7, allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_portlet_configuration_css_web_portlet_PortletConfigurationCSSPortlet_portletResource parameter.
References
| ▼ | URL | Tags |
|---|---|---|
| https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120748366 | x_refsource_CONFIRM | |
| https://issues.liferay.com/browse/LPE-17053 | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T23:50:41.594Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120748366"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://issues.liferay.com/browse/LPE-17053"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in the Portlet Configuration module in Liferay Portal 7.1.0 through 7.3.2, and Liferay DXP 7.1 before fix pack 19, and 7.2 before fix pack 7, allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_portlet_configuration_css_web_portlet_PortletConfigurationCSSPortlet_portletResource parameter."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-08-03T20:58:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120748366"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://issues.liferay.com/browse/LPE-17053"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2021-33332",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in the Portlet Configuration module in Liferay Portal 7.1.0 through 7.3.2, and Liferay DXP 7.1 before fix pack 19, and 7.2 before fix pack 7, allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_portlet_configuration_css_web_portlet_PortletConfigurationCSSPortlet_portletResource parameter."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120748366",
"refsource": "CONFIRM",
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120748366"
},
{
"name": "https://issues.liferay.com/browse/LPE-17053",
"refsource": "CONFIRM",
"url": "https://issues.liferay.com/browse/LPE-17053"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2021-33332",
"datePublished": "2021-08-03T20:58:01",
"dateReserved": "2021-05-20T00:00:00",
"dateUpdated": "2024-08-03T23:50:41.594Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2024-26268
Vulnerability from cvelistv5
Published
2024-02-20 13:17
Modified
2024-08-15 17:50
Severity ?
EPSS score ?
Summary
User enumeration vulnerability in Liferay Portal 7.2.0 through 7.4.3.26, and older unsupported versions, and Liferay DXP 7.4 before update 27, 7.3 before update 8, 7.2 before fix pack 20, and older unsupported versions allows remote attackers to determine if an account exist in the application by comparing the request's response time.
References
Impacted products
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T00:07:19.174Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-26268"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"cpes": [
"cpe:2.3:a:liferay:liferay_enterprise_portal:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "liferay_enterprise_portal",
"vendor": "liferay",
"versions": [
{
"lessThanOrEqual": "7.4.3.26",
"status": "affected",
"version": "7.2.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:ibexa:digital_experience_platform:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "digital_experience_platform",
"vendor": "ibexa",
"versions": [
{
"lessThanOrEqual": "7.4.13.u26",
"status": "affected",
"version": "7.4.13",
"versionType": "custom"
},
{
"lessThanOrEqual": "7.3.10.u7",
"status": "affected",
"version": "7.3.10",
"versionType": "custom"
},
{
"lessThanOrEqual": "7.2.10-dxp-19",
"status": "affected",
"version": "7.2.10",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-26268",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-02-20T16:17:11.147707Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-08-15T17:50:15.783Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Portal",
"vendor": "Liferay",
"versions": [
{
"lessThanOrEqual": "7.4.3.26",
"status": "affected",
"version": "7.2.0",
"versionType": "maven"
}
]
},
{
"defaultStatus": "unknown",
"product": "DXP",
"vendor": "Liferay",
"versions": [
{
"lessThanOrEqual": "7.4.13.u26",
"status": "affected",
"version": "7.4.13",
"versionType": "maven"
},
{
"lessThanOrEqual": "7.3.10.u7",
"status": "affected",
"version": "7.3.10",
"versionType": "maven"
},
{
"lessThanOrEqual": "7.2.10-dxp-19",
"status": "affected",
"version": "7.2.10",
"versionType": "maven"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"user": "00000000-0000-4000-9000-000000000000",
"value": "Barnab\u00e1s Horv\u00e1th (T4r0)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "User enumeration vulnerability in Liferay Portal 7.2.0 through 7.4.3.26, and older unsupported versions, and Liferay DXP 7.4 before update 27, 7.3 before update 8, 7.2 before fix pack 20, and older unsupported versions allows remote attackers to determine if an account exist in the application by comparing the request\u0027s response time."
}
],
"value": "User enumeration vulnerability in Liferay Portal 7.2.0 through 7.4.3.26, and older unsupported versions, and Liferay DXP 7.4 before update 27, 7.3 before update 8, 7.2 before fix pack 20, and older unsupported versions allows remote attackers to determine if an account exist in the application by comparing the request\u0027s response time."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-203",
"description": "CWE-203 Observable Discrepancy",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-02-21T03:50:53.570Z",
"orgId": "8b54e794-c6f0-462e-9faa-c1001a673ac3",
"shortName": "Liferay"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-26268"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "8b54e794-c6f0-462e-9faa-c1001a673ac3",
"assignerShortName": "Liferay",
"cveId": "CVE-2024-26268",
"datePublished": "2024-02-20T13:17:28.137Z",
"dateReserved": "2024-02-15T07:44:36.776Z",
"dateUpdated": "2024-08-15T17:50:15.783Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2021-29046
Vulnerability from cvelistv5
Published
2021-05-17 10:27
Modified
2024-08-03 21:55
Severity ?
EPSS score ?
Summary
Cross-site scripting (XSS) vulnerability in the Asset module's category selector input field in Liferay Portal 7.3.5 and Liferay DXP 7.3 before fix pack 1, allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_asset_categories_admin_web_portlet_AssetCategoriesAdminPortlet_title parameter.
References
| ▼ | URL | Tags |
|---|---|---|
| http://liferay.com | x_refsource_MISC | |
| https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120743501 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T21:55:12.635Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://liferay.com"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120743501"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in the Asset module\u0027s category selector input field in Liferay Portal 7.3.5 and Liferay DXP 7.3 before fix pack 1, allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_asset_categories_admin_web_portlet_AssetCategoriesAdminPortlet_title parameter."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-05-17T10:27:37",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "http://liferay.com"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120743501"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2021-29046",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in the Asset module\u0027s category selector input field in Liferay Portal 7.3.5 and Liferay DXP 7.3 before fix pack 1, allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_asset_categories_admin_web_portlet_AssetCategoriesAdminPortlet_title parameter."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://liferay.com",
"refsource": "MISC",
"url": "http://liferay.com"
},
{
"name": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120743501",
"refsource": "MISC",
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120743501"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2021-29046",
"datePublished": "2021-05-17T10:27:37",
"dateReserved": "2021-03-22T00:00:00",
"dateUpdated": "2024-08-03T21:55:12.635Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2021-33328
Vulnerability from cvelistv5
Published
2021-08-03 18:41
Modified
2024-08-03 23:50
Severity ?
EPSS score ?
Summary
Cross-site scripting (XSS) vulnerability in the Asset module's edit vocabulary page in Liferay Portal 7.0.0 through 7.3.4, and Liferay DXP 7.0 before fix pack 96, 7.1 before fix pack 20, and 7.2 before fix pack 9, allows remote attackers to inject arbitrary web script or HTML via the (1) _com_liferay_journal_web_portlet_JournalPortlet_name or (2) _com_liferay_document_library_web_portlet_DLAdminPortlet_name parameter.
References
| ▼ | URL | Tags |
|---|---|---|
| https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120747972 | x_refsource_CONFIRM | |
| https://issues.liferay.com/browse/LPE-17100 | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T23:50:41.587Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120747972"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://issues.liferay.com/browse/LPE-17100"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in the Asset module\u0027s edit vocabulary page in Liferay Portal 7.0.0 through 7.3.4, and Liferay DXP 7.0 before fix pack 96, 7.1 before fix pack 20, and 7.2 before fix pack 9, allows remote attackers to inject arbitrary web script or HTML via the (1) _com_liferay_journal_web_portlet_JournalPortlet_name or (2) _com_liferay_document_library_web_portlet_DLAdminPortlet_name parameter."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-08-03T18:41:46",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120747972"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://issues.liferay.com/browse/LPE-17100"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2021-33328",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in the Asset module\u0027s edit vocabulary page in Liferay Portal 7.0.0 through 7.3.4, and Liferay DXP 7.0 before fix pack 96, 7.1 before fix pack 20, and 7.2 before fix pack 9, allows remote attackers to inject arbitrary web script or HTML via the (1) _com_liferay_journal_web_portlet_JournalPortlet_name or (2) _com_liferay_document_library_web_portlet_DLAdminPortlet_name parameter."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120747972",
"refsource": "CONFIRM",
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120747972"
},
{
"name": "https://issues.liferay.com/browse/LPE-17100",
"refsource": "CONFIRM",
"url": "https://issues.liferay.com/browse/LPE-17100"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2021-33328",
"datePublished": "2021-08-03T18:41:46",
"dateReserved": "2021-05-20T00:00:00",
"dateUpdated": "2024-08-03T23:50:41.587Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2023-47798
Vulnerability from cvelistv5
Published
2024-02-08 02:55
Modified
2024-08-02 21:16
Severity ?
EPSS score ?
Summary
Account lockout in Liferay Portal 7.2.0 through 7.3.0, and older unsupported versions, and Liferay DXP 7.2 before fix pack 5, and older unsupported versions does not invalidate existing user sessions, which allows remote authenticated users to remain authenticated after an account has been locked.
References
Impacted products
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T21:16:43.623Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-47798"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Portal",
"vendor": "Liferay",
"versions": [
{
"lessThanOrEqual": "7.3.0",
"status": "affected",
"version": "7.2.0",
"versionType": "maven"
}
]
},
{
"defaultStatus": "unknown",
"product": "DXP",
"vendor": "Liferay",
"versions": [
{
"lessThanOrEqual": "7.2.10-dxp-4",
"status": "affected",
"version": "7.2.10",
"versionType": "maven"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Account lockout in Liferay Portal 7.2.0 through 7.3.0, and older unsupported versions, and Liferay DXP 7.2 before fix pack 5, and older unsupported versions does not invalidate existing user sessions, which allows remote authenticated users to remain authenticated after an account has been locked."
}
],
"value": "Account lockout in Liferay Portal 7.2.0 through 7.3.0, and older unsupported versions, and Liferay DXP 7.2 before fix pack 5, and older unsupported versions does not invalidate existing user sessions, which allows remote authenticated users to remain authenticated after an account has been locked."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-384",
"description": "CWE-384 Session Fixation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-02-08T02:55:43.923Z",
"orgId": "8b54e794-c6f0-462e-9faa-c1001a673ac3",
"shortName": "Liferay"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-47798"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "8b54e794-c6f0-462e-9faa-c1001a673ac3",
"assignerShortName": "Liferay",
"cveId": "CVE-2023-47798",
"datePublished": "2024-02-08T02:55:43.923Z",
"dateReserved": "2023-11-10T01:49:20.188Z",
"dateUpdated": "2024-08-02T21:16:43.623Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2024-11993
Vulnerability from cvelistv5
Published
2024-12-17 20:24
Modified
2024-12-17 21:24
Severity ?
EPSS score ?
Summary
Reflected cross-site scripting (XSS) vulnerability in Liferay Portal 7.1.0 through 7.4.3.38, and Liferay DXP 7.4 GA through update 38, 7.3 GA through update 36, 7.2 GA through fix pack 20 and 7.1 GA through fix pack 28 allows remote attackers to execute arbitrary web script or HTML via Dispatch name field
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-11993",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-12-17T21:24:48.114546Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-12-17T21:24:55.247Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Portal",
"vendor": "Liferay",
"versions": [
{
"lessThanOrEqual": "7.4.3.38",
"status": "affected",
"version": "7.1.0",
"versionType": "maven"
}
]
},
{
"defaultStatus": "unaffected",
"product": "DXP",
"vendor": "Liferay",
"versions": [
{
"lessThanOrEqual": "dxp-28",
"status": "affected",
"version": "7.1.10",
"versionType": "maven"
},
{
"lessThanOrEqual": "dxp-20",
"status": "affected",
"version": "7.2.10",
"versionType": "maven"
},
{
"lessThanOrEqual": "7.3.10-u36",
"status": "affected",
"version": "7.3.10",
"versionType": "maven"
},
{
"lessThanOrEqual": "7.4.13-u38",
"status": "affected",
"version": "7.4.13",
"versionType": "maven"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Liferay"
},
{
"lang": "en",
"type": "reporter",
"value": "milCERT AT"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Reflected cross-site scripting (XSS) vulnerability in Liferay Portal 7.1.0 through 7.4.3.38, and Liferay DXP 7.4 GA through update 38, 7.3 GA through update 36, 7.2 GA through fix pack 20 and 7.1 GA through fix pack 28 allows remote attackers to execute arbitrary web script or HTML via Dispatch name field\u003cbr\u003e"
}
],
"value": "Reflected cross-site scripting (XSS) vulnerability in Liferay Portal 7.1.0 through 7.4.3.38, and Liferay DXP 7.4 GA through update 38, 7.3 GA through update 36, 7.2 GA through fix pack 20 and 7.1 GA through fix pack 28 allows remote attackers to execute arbitrary web script or HTML via Dispatch name field"
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 4.6,
"baseSeverity": "MEDIUM",
"privilegesRequired": "HIGH",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "ACTIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or \u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-12-17T20:24:42.600Z",
"orgId": "8b54e794-c6f0-462e-9faa-c1001a673ac3",
"shortName": "Liferay"
},
"references": [
{
"url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2024-11993"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "8b54e794-c6f0-462e-9faa-c1001a673ac3",
"assignerShortName": "Liferay",
"cveId": "CVE-2024-11993",
"datePublished": "2024-12-17T20:24:42.600Z",
"dateReserved": "2024-11-29T11:32:54.553Z",
"dateUpdated": "2024-12-17T21:24:55.247Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2024-25152
Vulnerability from cvelistv5
Published
2024-02-21 02:00
Modified
2024-08-26 16:52
Severity ?
EPSS score ?
Summary
Stored cross-site scripting (XSS) vulnerability in Message Board widget in Liferay Portal 7.2.0 through 7.4.2, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 17, and older unsupported versions allows remote authenticated users to inject arbitrary web script or HTML via the filename of an attachment.
References
Impacted products
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-01T23:36:21.821Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25152"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"cpes": [
"cpe:2.3:a:liferay:liferay_portal:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "liferay_portal",
"vendor": "liferay",
"versions": [
{
"lessThan": "7.4.2",
"status": "affected",
"version": "7.2.0",
"versionType": "maven"
}
]
},
{
"cpes": [
"cpe:2.3:a:liferay:digital_experience_platform:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "digital_experience_platform",
"vendor": "liferay",
"versions": [
{
"lessThanOrEqual": "7.3.10-dxp-",
"status": "affected",
"version": "7.3.10",
"versionType": "maven"
},
{
"lessThanOrEqual": "7.2.10-dxp-16",
"status": "affected",
"version": "7.2.10",
"versionType": "maven"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-25152",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-02-21T19:54:47.190614Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-08-26T16:52:06.441Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Portal",
"vendor": "Liferay",
"versions": [
{
"lessThanOrEqual": "7.4.2",
"status": "affected",
"version": "7.2.0",
"versionType": "maven"
}
]
},
{
"defaultStatus": "unknown",
"product": "DXP",
"vendor": "Liferay",
"versions": [
{
"lessThanOrEqual": "7.3.10-dxp-2",
"status": "affected",
"version": "7.3.10",
"versionType": "maven"
},
{
"lessThanOrEqual": "7.2.10-dxp-16",
"status": "affected",
"version": "7.2.10",
"versionType": "maven"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Stored cross-site scripting (XSS) vulnerability in Message Board widget in Liferay Portal 7.2.0 through 7.4.2, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 17, and older unsupported versions allows remote authenticated users to inject arbitrary web script or HTML via the filename of an attachment."
}
],
"value": "Stored cross-site scripting (XSS) vulnerability in Message Board widget in Liferay Portal 7.2.0 through 7.4.2, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 17, and older unsupported versions allows remote authenticated users to inject arbitrary web script or HTML via the filename of an attachment."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-02-21T02:00:32.694Z",
"orgId": "8b54e794-c6f0-462e-9faa-c1001a673ac3",
"shortName": "Liferay"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25152"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "8b54e794-c6f0-462e-9faa-c1001a673ac3",
"assignerShortName": "Liferay",
"cveId": "CVE-2024-25152",
"datePublished": "2024-02-21T02:00:32.694Z",
"dateReserved": "2024-02-06T10:32:42.567Z",
"dateUpdated": "2024-08-26T16:52:06.441Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2023-33949
Vulnerability from cvelistv5
Published
2023-05-24 16:01
Modified
2024-10-22 15:51
Severity ?
EPSS score ?
Summary
In Liferay Portal 7.3.0 and earlier, and Liferay DXP 7.2 and earlier the default configuration does not require users to verify their email address, which allows remote attackers to create accounts using fake email addresses or email addresses which they don't control. The portal property `company.security.strangers.verify` should be set to true.
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T15:54:14.057Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-33949"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-33949",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-10-22T15:48:38.903885Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-10-22T15:51:31.464Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Portal",
"vendor": "Liferay",
"versions": [
{
"lessThanOrEqual": "7.3.0",
"status": "affected",
"version": "0",
"versionType": "maven"
}
]
},
{
"defaultStatus": "unaffected",
"product": "DXP",
"vendor": "Liferay",
"versions": [
{
"lessThan": "7.3.10",
"status": "affected",
"version": "0",
"versionType": "maven"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "In Liferay Portal 7.3.0 and earlier, and Liferay DXP 7.2 and earlier the default configuration does not require users to verify their email address, which allows remote attackers to create accounts using fake email addresses or email addresses which they don\u0027t control. The portal property `company.security.strangers.verify` should be set to true."
}
],
"value": "In Liferay Portal 7.3.0 and earlier, and Liferay DXP 7.2 and earlier the default configuration does not require users to verify their email address, which allows remote attackers to create accounts using fake email addresses or email addresses which they don\u0027t control. The portal property `company.security.strangers.verify` should be set to true."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1188",
"description": "CWE-1188 Insecure Default Initialization of Resource",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-05-24T16:01:55.501Z",
"orgId": "8b54e794-c6f0-462e-9faa-c1001a673ac3",
"shortName": "Liferay"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-33949"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "8b54e794-c6f0-462e-9faa-c1001a673ac3",
"assignerShortName": "Liferay",
"cveId": "CVE-2023-33949",
"datePublished": "2023-05-24T16:01:55.501Z",
"dateReserved": "2023-05-24T02:36:00.165Z",
"dateUpdated": "2024-10-22T15:51:31.464Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2023-44310
Vulnerability from cvelistv5
Published
2023-10-17 09:28
Modified
2024-09-13 16:31
Severity ?
EPSS score ?
Summary
Stored cross-site scripting (XSS) vulnerability in Page Tree menu Liferay Portal 7.3.6 through 7.4.3.78, and Liferay DXP 7.3 fix pack 1 through update 23, and 7.4 before update 79 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into page's "Name" text field.
References
Impacted products
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T19:59:51.964Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-44310"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-44310",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-13T16:31:02.702958Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-13T16:31:11.575Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "DXP",
"vendor": "Liferay",
"versions": [
{
"lessThanOrEqual": "7.3.10.u23",
"status": "affected",
"version": "7.3.10.sp1",
"versionType": "maven"
},
{
"lessThanOrEqual": "7.4.13.u78",
"status": "affected",
"version": "7.4.13",
"versionType": "maven"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Portal",
"vendor": "Liferay",
"versions": [
{
"lessThanOrEqual": "7.4.3.78",
"status": "affected",
"version": "7.3.6",
"versionType": "maven"
}
]
}
],
"datePublic": "2023-10-17T07:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Stored cross-site scripting (XSS) vulnerability in Page Tree menu Liferay Portal 7.3.6 through 7.4.3.78, and Liferay DXP 7.3 fix pack 1 through update 23, and 7.4 before update 79 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into page\u0027s \"Name\" text field."
}
],
"value": "Stored cross-site scripting (XSS) vulnerability in Page Tree menu Liferay Portal 7.3.6 through 7.4.3.78, and Liferay DXP 7.3 fix pack 1 through update 23, and 7.4 before update 79 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into page\u0027s \"Name\" text field."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-10-17T09:28:17.244Z",
"orgId": "8b54e794-c6f0-462e-9faa-c1001a673ac3",
"shortName": "Liferay"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-44310"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "8b54e794-c6f0-462e-9faa-c1001a673ac3",
"assignerShortName": "Liferay",
"cveId": "CVE-2023-44310",
"datePublished": "2023-10-17T09:28:17.244Z",
"dateReserved": "2023-09-28T11:23:54.829Z",
"dateUpdated": "2024-09-13T16:31:11.575Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2024-8980
Vulnerability from cvelistv5
Published
2024-10-22 14:43
Modified
2024-10-22 15:08
Severity ?
EPSS score ?
Summary
The Script Console in Liferay Portal 7.0.0 through 7.4.3.101, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, 7.2 GA through fix pack 20, 7.1 GA through fix pack 28, 7.0 GA through fix pack 102 and 6.2 GA through fix pack 173
does not sufficiently protect against Cross-Site Request Forgery (CSRF) attacks, which allows remote attackers to execute arbitrary Groovy script via a crafted URL or a XSS vulnerability.
References
Impacted products
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:liferay:portal:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "portal",
"vendor": "liferay",
"versions": [
{
"lessThanOrEqual": "7.4.3.101",
"status": "affected",
"version": "7.4.0",
"versionType": "maven"
},
{
"lessThanOrEqual": "7.3.7",
"status": "affected",
"version": "7.3.0",
"versionType": "maven"
},
{
"lessThanOrEqual": "7.2.1",
"status": "affected",
"version": "7.2.0",
"versionType": "maven"
},
{
"lessThanOrEqual": "7.1.3",
"status": "affected",
"version": "7.1.0",
"versionType": "maven"
},
{
"lessThanOrEqual": "2023.q3.4",
"status": "affected",
"version": "7.0.0",
"versionType": "maven"
}
]
},
{
"cpes": [
"cpe:2.3:a:liferay:dxp:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "dxp",
"vendor": "liferay",
"versions": [
{
"lessThanOrEqual": "2023.q3.4",
"status": "affected",
"version": "2023.q3.1",
"versionType": "maven"
},
{
"status": "affected",
"version": "7.4"
},
{
"lessThanOrEqual": "update35",
"status": "affected",
"version": "7.3ga",
"versionType": "maven"
},
{
"status": "affected",
"version": "7.2"
},
{
"status": "affected",
"version": "7.1"
},
{
"status": "affected",
"version": "7.0"
},
{
"status": "affected",
"version": "6.2"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-8980",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-10-22T15:02:17.489238Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-10-22T15:08:48.472Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Portal",
"vendor": "Liferay",
"versions": [
{
"lessThanOrEqual": "7.4.3.101",
"status": "affected",
"version": "7.0.0",
"versionType": "maven"
}
]
},
{
"defaultStatus": "unaffected",
"product": "DXP",
"vendor": "Liferay",
"versions": [
{
"lessThanOrEqual": "portal-173",
"status": "affected",
"version": "6.2.0",
"versionType": "maven"
},
{
"lessThanOrEqual": "de-102",
"status": "affected",
"version": "7.0.10",
"versionType": "maven"
},
{
"lessThanOrEqual": "dxp-28",
"status": "affected",
"version": "7.1.10",
"versionType": "maven"
},
{
"lessThanOrEqual": "dxp-20",
"status": "affected",
"version": "7.2.10",
"versionType": "maven"
},
{
"lessThanOrEqual": "7.3.10-u35",
"status": "affected",
"version": "7.3.10",
"versionType": "maven"
},
{
"lessThanOrEqual": "7.4.13-u92",
"status": "affected",
"version": "7.4.13",
"versionType": "maven"
},
{
"lessThanOrEqual": "2023.Q3.4",
"status": "affected",
"version": "2023.Q3.1",
"versionType": "maven"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The Script Console in Liferay Portal 7.0.0 through 7.4.3.101, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, 7.2 GA through fix pack 20, 7.1 GA through fix pack 28, 7.0 GA through fix pack 102 and 6.2 GA through fix pack 173\u003cbr\u003e does not sufficiently protect against Cross-Site Request Forgery (CSRF) attacks, which allows remote attackers to execute arbitrary Groovy script via a crafted URL or a XSS vulnerability."
}
],
"value": "The Script Console in Liferay Portal 7.0.0 through 7.4.3.101, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, 7.2 GA through fix pack 20, 7.1 GA through fix pack 28, 7.0 GA through fix pack 102 and 6.2 GA through fix pack 173\n does not sufficiently protect against Cross-Site Request Forgery (CSRF) attacks, which allows remote attackers to execute arbitrary Groovy script via a crafted URL or a XSS vulnerability."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.6,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-352",
"description": "CWE-352 Cross-Site Request Forgery (CSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-10-22T14:43:04.606Z",
"orgId": "8b54e794-c6f0-462e-9faa-c1001a673ac3",
"shortName": "Liferay"
},
"references": [
{
"url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2024-8980"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "8b54e794-c6f0-462e-9faa-c1001a673ac3",
"assignerShortName": "Liferay",
"cveId": "CVE-2024-8980",
"datePublished": "2024-10-22T14:43:04.606Z",
"dateReserved": "2024-09-18T18:04:13.531Z",
"dateUpdated": "2024-10-22T15:08:48.472Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2021-29048
Vulnerability from cvelistv5
Published
2021-05-17 11:08
Modified
2024-08-03 21:55
Severity ?
EPSS score ?
Summary
Cross-site scripting (XSS) vulnerability in the Layout module's page administration page in Liferay Portal 7.3.4, 7.3.5 and Liferay DXP 7.2 before fix pack 11 and 7.3 before fix pack 1 allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_layout_admin_web_portlet_GroupPagesPortlet_name parameter.
References
| ▼ | URL | Tags |
|---|---|---|
| http://liferay.com | x_refsource_MISC | |
| https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120743601 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T21:55:12.617Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://liferay.com"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120743601"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in the Layout module\u0027s page administration page in Liferay Portal 7.3.4, 7.3.5 and Liferay DXP 7.2 before fix pack 11 and 7.3 before fix pack 1 allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_layout_admin_web_portlet_GroupPagesPortlet_name parameter."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-05-17T11:08:23",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "http://liferay.com"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120743601"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2021-29048",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in the Layout module\u0027s page administration page in Liferay Portal 7.3.4, 7.3.5 and Liferay DXP 7.2 before fix pack 11 and 7.3 before fix pack 1 allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_layout_admin_web_portlet_GroupPagesPortlet_name parameter."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://liferay.com",
"refsource": "MISC",
"url": "http://liferay.com"
},
{
"name": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120743601",
"refsource": "MISC",
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120743601"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2021-29048",
"datePublished": "2021-05-17T11:08:23",
"dateReserved": "2021-03-22T00:00:00",
"dateUpdated": "2024-08-03T21:55:12.617Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2022-42122
Vulnerability from cvelistv5
Published
2022-11-15 00:00
Modified
2024-08-03 13:03
Severity ?
EPSS score ?
Summary
A SQL injection vulnerability in the Friendly Url module in Liferay Portal 7.3.7, and Liferay DXP 7.3 fix pack 2 through update 4 allows attackers to execute arbitrary SQL commands via a crafted payload injected into the `title` field of a friendly URL.
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T13:03:44.108Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "http://liferay.com"
},
{
"tags": [
"x_transferred"
],
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42122"
},
{
"tags": [
"x_transferred"
],
"url": "https://issues.liferay.com/browse/LPE-17520"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A SQL injection vulnerability in the Friendly Url module in Liferay Portal 7.3.7, and Liferay DXP 7.3 fix pack 2 through update 4 allows attackers to execute arbitrary SQL commands via a crafted payload injected into the `title` field of a friendly URL."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-11-15T00:00:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "http://liferay.com"
},
{
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42122"
},
{
"url": "https://issues.liferay.com/browse/LPE-17520"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2022-42122",
"datePublished": "2022-11-15T00:00:00",
"dateReserved": "2022-10-03T00:00:00",
"dateUpdated": "2024-08-03T13:03:44.108Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2023-44311
Vulnerability from cvelistv5
Published
2023-10-17 09:39
Modified
2024-09-13 16:28
Severity ?
EPSS score ?
Summary
Multiple reflected cross-site scripting (XSS) vulnerabilities in the Plugin for OAuth 2.0 module's OAuth2ProviderApplicationRedirect class in Liferay Portal 7.4.3.41 through 7.4.3.89, and Liferay DXP 7.4 update 41 through update 89 allow remote attackers to inject arbitrary web script or HTML via the (1) code, or (2) error parameter. This issue is caused by an incomplete fix in CVE-2023-33941.
References
Impacted products
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T19:59:51.988Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-44311"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-44311",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-13T16:28:36.237243Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-13T16:28:45.098Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "DXP",
"vendor": "Liferay",
"versions": [
{
"lessThanOrEqual": "7.4.13.u89",
"status": "affected",
"version": "7.4.13.u41",
"versionType": "maven"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Portal",
"vendor": "Liferay",
"versions": [
{
"lessThanOrEqual": "7.4.3.89",
"status": "affected",
"version": "7.4.3.41",
"versionType": "maven"
}
]
}
],
"datePublic": "2023-10-17T07:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Multiple reflected cross-site scripting (XSS) vulnerabilities in the Plugin for OAuth 2.0 module\u0027s OAuth2ProviderApplicationRedirect class in Liferay Portal 7.4.3.41 through 7.4.3.89, and Liferay DXP 7.4 update 41 through update 89 allow remote attackers to inject arbitrary web script or HTML via the (1) code, or (2) error parameter. This issue is caused by an incomplete fix in CVE-2023-33941."
}
],
"value": "Multiple reflected cross-site scripting (XSS) vulnerabilities in the Plugin for OAuth 2.0 module\u0027s OAuth2ProviderApplicationRedirect class in Liferay Portal 7.4.3.41 through 7.4.3.89, and Liferay DXP 7.4 update 41 through update 89 allow remote attackers to inject arbitrary web script or HTML via the (1) code, or (2) error parameter. This issue is caused by an incomplete fix in CVE-2023-33941."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.6,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-10-17T09:39:07.508Z",
"orgId": "8b54e794-c6f0-462e-9faa-c1001a673ac3",
"shortName": "Liferay"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-44311"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "8b54e794-c6f0-462e-9faa-c1001a673ac3",
"assignerShortName": "Liferay",
"cveId": "CVE-2023-44311",
"datePublished": "2023-10-17T09:39:07.508Z",
"dateReserved": "2023-09-28T11:23:54.829Z",
"dateUpdated": "2024-09-13T16:28:45.098Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2022-42116
Vulnerability from cvelistv5
Published
2022-10-18 00:00
Modified
2024-08-03 13:03
Severity ?
EPSS score ?
Summary
A Cross-site scripting (XSS) vulnerability in the Frontend Editor module's integration with CKEditor in Liferay Portal 7.3.2 through 7.4.3.14, and Liferay DXP 7.3 before update 6, and 7.4 before update 15 allows remote attackers to inject arbitrary web script or HTML via the (1) name, or (2) namespace parameter.
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T13:03:45.784Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "http://liferay.com"
},
{
"tags": [
"x_transferred"
],
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42116"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A Cross-site scripting (XSS) vulnerability in the Frontend Editor module\u0027s integration with CKEditor in Liferay Portal 7.3.2 through 7.4.3.14, and Liferay DXP 7.3 before update 6, and 7.4 before update 15 allows remote attackers to inject arbitrary web script or HTML via the (1) name, or (2) namespace parameter."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-10-18T00:00:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "http://liferay.com"
},
{
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42116"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2022-42116",
"datePublished": "2022-10-18T00:00:00",
"dateReserved": "2022-10-03T00:00:00",
"dateUpdated": "2024-08-03T13:03:45.784Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2022-38902
Vulnerability from cvelistv5
Published
2022-10-13 00:00
Modified
2024-08-03 11:02
Severity ?
EPSS score ?
Summary
A Cross-site scripting (XSS) vulnerability in the Blog module - add new topic functionality in Liferay Digital Experience Platform 7.3.10 SP3 allows remote attackers to inject arbitrary JS script or HTML into the name field of newly created topic.
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T11:02:14.682Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "http://liferay.com"
},
{
"tags": [
"x_transferred"
],
"url": "https://drive.proton.me/urls/D27RQ14NGW#b71d8XrBl2Mu"
},
{
"tags": [
"x_transferred"
],
"url": "https://www.offensity.com/en/blog/authenticated-persistent-xss-in-liferay-dxp-cms-cve-2022-38901-and-cve-2022-38902/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A Cross-site scripting (XSS) vulnerability in the Blog module - add new topic functionality in Liferay Digital Experience Platform 7.3.10 SP3 allows remote attackers to inject arbitrary JS script or HTML into the name field of newly created topic."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-10-13T00:00:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "http://liferay.com"
},
{
"url": "https://drive.proton.me/urls/D27RQ14NGW#b71d8XrBl2Mu"
},
{
"url": "https://www.offensity.com/en/blog/authenticated-persistent-xss-in-liferay-dxp-cms-cve-2022-38901-and-cve-2022-38902/"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2022-38902",
"datePublished": "2022-10-13T00:00:00",
"dateReserved": "2022-08-29T00:00:00",
"dateUpdated": "2024-08-03T11:02:14.682Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2023-33939
Vulnerability from cvelistv5
Published
2023-05-24 13:41
Modified
2024-10-22 15:52
Severity ?
EPSS score ?
Summary
Cross-site scripting (XSS) vulnerability in the Modified Facet widget in Liferay Portal 7.1.0 through 7.4.3.12, and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 18, 7.3 before update 4, and 7.4 before update 9 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a facet label.
References
Impacted products
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T15:54:13.948Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-33939"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-33939",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-10-22T15:45:50.988282Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-10-22T15:52:40.777Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Portal",
"vendor": "Liferay",
"versions": [
{
"lessThanOrEqual": "7.4.3.12",
"status": "affected",
"version": "7.1.0",
"versionType": "maven"
}
]
},
{
"defaultStatus": "unaffected",
"product": "DXP",
"vendor": "Liferay",
"versions": [
{
"lessThanOrEqual": "7.1.10-dxp-26",
"status": "affected",
"version": "7.1.10",
"versionType": "maven"
},
{
"lessThanOrEqual": "7.2.10-dxp-17",
"status": "affected",
"version": "7.2.10",
"versionType": "maven"
},
{
"lessThanOrEqual": "7.3.10-sp3",
"status": "affected",
"version": "7.3.10",
"versionType": "maven"
},
{
"lessThanOrEqual": "7.4.13.u8",
"status": "affected",
"version": "7.4.13",
"versionType": "maven"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Cross-site scripting (XSS) vulnerability in the Modified Facet widget in Liferay Portal 7.1.0 through 7.4.3.12, and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 18, 7.3 before update 4, and 7.4 before update 9 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a facet label."
}
],
"value": "Cross-site scripting (XSS) vulnerability in the Modified Facet widget in Liferay Portal 7.1.0 through 7.4.3.12, and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 18, 7.3 before update 4, and 7.4 before update 9 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a facet label."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-05-24T13:41:22.321Z",
"orgId": "8b54e794-c6f0-462e-9faa-c1001a673ac3",
"shortName": "Liferay"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-33939"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "8b54e794-c6f0-462e-9faa-c1001a673ac3",
"assignerShortName": "Liferay",
"cveId": "CVE-2023-33939",
"datePublished": "2023-05-24T13:41:22.321Z",
"dateReserved": "2023-05-24T02:36:00.163Z",
"dateUpdated": "2024-10-22T15:52:40.777Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2024-26273
Vulnerability from cvelistv5
Published
2024-10-22 15:01
Modified
2024-10-22 15:20
Severity ?
EPSS score ?
Summary
Cross-site request forgery (CSRF) vulnerability in the content page editor in Liferay Portal 7.4.0 through 7.4.3.103, and Liferay DXP 2023.Q4.0 through 2023.Q4.2, 2023.Q3.1 through 2023.Q3.5, 7.4 GA through update 92 and 7.3 update 29 through update 35 allows remote attackers to (1) change user passwords, (2) shut down the server, (3) execute arbitrary code in the scripting console, (4) and perform other administrative actions via the _com_liferay_commerce_catalog_web_internal_portlet_CommerceCatalogsPortlet_redirect parameter.
References
Impacted products
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:liferay:portal:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "portal",
"vendor": "liferay",
"versions": [
{
"lessThanOrEqual": "7.4.3.103",
"status": "affected",
"version": "7.4.0",
"versionType": "maven"
}
]
},
{
"cpes": [
"cpe:2.3:a:liferay:dxp:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "dxp",
"vendor": "liferay",
"versions": [
{
"lessThanOrEqual": "2023.q4.2",
"status": "affected",
"version": "2023.q4.0",
"versionType": "maven"
},
{
"lessThanOrEqual": "2023.q3.5",
"status": "affected",
"version": "2023.q3.1",
"versionType": "maven"
},
{
"status": "affected",
"version": "7.4"
},
{
"lessThanOrEqual": "update35",
"status": "affected",
"version": "7.3update29",
"versionType": "maven"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-26273",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-10-22T15:18:21.690865Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-10-22T15:20:22.553Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Portal",
"vendor": "Liferay",
"versions": [
{
"lessThanOrEqual": "7.4.3.103",
"status": "affected",
"version": "7.4.0",
"versionType": "maven"
}
]
},
{
"defaultStatus": "unaffected",
"product": "DXP",
"vendor": "Liferay",
"versions": [
{
"lessThanOrEqual": "7.3.10-u35",
"status": "affected",
"version": "7.3.10-u29",
"versionType": "maven"
},
{
"lessThanOrEqual": "7.4.13-u92",
"status": "affected",
"version": "7.4.13",
"versionType": "maven"
},
{
"lessThanOrEqual": "2023.Q3.5",
"status": "affected",
"version": "2023.Q3.1",
"versionType": "maven"
},
{
"lessThanOrEqual": "2023.Q4.2",
"status": "affected",
"version": "2023.Q4.0",
"versionType": "maven"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Cross-site request forgery (CSRF) vulnerability in the content page editor in Liferay Portal 7.4.0 through 7.4.3.103, and Liferay DXP 2023.Q4.0 through 2023.Q4.2, 2023.Q3.1 through 2023.Q3.5, 7.4 GA through update 92 and 7.3 update 29 through update 35 allows remote attackers to (1) change user passwords, (2) shut down the server, (3) execute arbitrary code in the scripting console, (4) and perform other administrative actions via the _com_liferay_commerce_catalog_web_internal_portlet_CommerceCatalogsPortlet_redirect parameter."
}
],
"value": "Cross-site request forgery (CSRF) vulnerability in the content page editor in Liferay Portal 7.4.0 through 7.4.3.103, and Liferay DXP 2023.Q4.0 through 2023.Q4.2, 2023.Q3.1 through 2023.Q3.5, 7.4 GA through update 92 and 7.3 update 29 through update 35 allows remote attackers to (1) change user passwords, (2) shut down the server, (3) execute arbitrary code in the scripting console, (4) and perform other administrative actions via the _com_liferay_commerce_catalog_web_internal_portlet_CommerceCatalogsPortlet_redirect parameter."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-352",
"description": "CWE-352 Cross-Site Request Forgery (CSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-10-22T15:01:29.395Z",
"orgId": "8b54e794-c6f0-462e-9faa-c1001a673ac3",
"shortName": "Liferay"
},
"references": [
{
"url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2024-26273"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "8b54e794-c6f0-462e-9faa-c1001a673ac3",
"assignerShortName": "Liferay",
"cveId": "CVE-2024-26273",
"datePublished": "2024-10-22T15:01:29.395Z",
"dateReserved": "2024-02-15T07:44:36.776Z",
"dateUpdated": "2024-10-22T15:20:22.553Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2022-42113
Vulnerability from cvelistv5
Published
2022-10-18 00:00
Modified
2024-08-03 13:03
Severity ?
EPSS score ?
Summary
A Cross-site scripting (XSS) vulnerability in Document Library module in Liferay Portal 7.4.3.30 through 7.4.3.36, and Liferay DXP 7.4 update 30 through update 36 allows remote attackers to inject arbitrary web script or HTML via the `redirect` parameter.
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T13:03:45.182Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "http://liferay.com"
},
{
"tags": [
"x_transferred"
],
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42113"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A Cross-site scripting (XSS) vulnerability in Document Library module in Liferay Portal 7.4.3.30 through 7.4.3.36, and Liferay DXP 7.4 update 30 through update 36 allows remote attackers to inject arbitrary web script or HTML via the `redirect` parameter."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-10-18T00:00:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "http://liferay.com"
},
{
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42113"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2022-42113",
"datePublished": "2022-10-18T00:00:00",
"dateReserved": "2022-10-03T00:00:00",
"dateUpdated": "2024-08-03T13:03:45.182Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2023-33942
Vulnerability from cvelistv5
Published
2023-05-24 14:49
Modified
2024-10-22 15:52
Severity ?
EPSS score ?
Summary
Cross-site scripting (XSS) vulnerability in the Web Content Display widget's article selector in Liferay Liferay Portal 7.4.3.50, and Liferay DXP 7.4 update 50 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a web content article's `Title` field.
References
Impacted products
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T15:54:13.949Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-33942"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-33942",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-10-22T15:47:21.518857Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-10-22T15:52:20.409Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Portal",
"vendor": "Liferay",
"versions": [
{
"status": "affected",
"version": "7.4.3.50"
}
]
},
{
"defaultStatus": "unaffected",
"product": "DXP",
"vendor": "Liferay",
"versions": [
{
"status": "affected",
"version": "7.4.13.u50"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Cross-site scripting (XSS) vulnerability in the Web Content Display widget\u0027s article selector in Liferay Liferay Portal 7.4.3.50, and Liferay DXP 7.4 update 50 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a web content article\u0027s `Title` field."
}
],
"value": "Cross-site scripting (XSS) vulnerability in the Web Content Display widget\u0027s article selector in Liferay Liferay Portal 7.4.3.50, and Liferay DXP 7.4 update 50 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a web content article\u0027s `Title` field."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-06-01T03:20:20.675Z",
"orgId": "8b54e794-c6f0-462e-9faa-c1001a673ac3",
"shortName": "Liferay"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-33942"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "8b54e794-c6f0-462e-9faa-c1001a673ac3",
"assignerShortName": "Liferay",
"cveId": "CVE-2023-33942",
"datePublished": "2023-05-24T14:49:17.472Z",
"dateReserved": "2023-05-24T02:36:00.163Z",
"dateUpdated": "2024-10-22T15:52:20.409Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2021-29047
Vulnerability from cvelistv5
Published
2021-05-16 15:29
Modified
2024-08-03 21:55
Severity ?
EPSS score ?
Summary
The SimpleCaptcha implementation in Liferay Portal 7.3.4, 7.3.5 and Liferay DXP 7.3 before fix pack 1 does not invalidate CAPTCHA answers after it is used, which allows remote attackers to repeatedly perform actions protected by a CAPTCHA challenge by reusing the same CAPTCHA answer.
References
| ▼ | URL | Tags |
|---|---|---|
| http://liferay.com | x_refsource_MISC | |
| https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120743467 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T21:55:12.508Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://liferay.com"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120743467"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The SimpleCaptcha implementation in Liferay Portal 7.3.4, 7.3.5 and Liferay DXP 7.3 before fix pack 1 does not invalidate CAPTCHA answers after it is used, which allows remote attackers to repeatedly perform actions protected by a CAPTCHA challenge by reusing the same CAPTCHA answer."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-05-16T15:29:52",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "http://liferay.com"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120743467"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2021-29047",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The SimpleCaptcha implementation in Liferay Portal 7.3.4, 7.3.5 and Liferay DXP 7.3 before fix pack 1 does not invalidate CAPTCHA answers after it is used, which allows remote attackers to repeatedly perform actions protected by a CAPTCHA challenge by reusing the same CAPTCHA answer."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://liferay.com",
"refsource": "MISC",
"url": "http://liferay.com"
},
{
"name": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120743467",
"refsource": "MISC",
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120743467"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2021-29047",
"datePublished": "2021-05-16T15:29:52",
"dateReserved": "2021-03-22T00:00:00",
"dateUpdated": "2024-08-03T21:55:12.508Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2021-29041
Vulnerability from cvelistv5
Published
2021-05-16 15:14
Modified
2024-08-03 21:55
Severity ?
EPSS score ?
Summary
Denial-of-service (DoS) vulnerability in the Multi-Factor Authentication module in Liferay DXP 7.3 before fix pack 1 allows remote authenticated attackers to prevent any user from authenticating by (1) enabling Time-based One-time password (TOTP) on behalf of the other user or (2) modifying the other user's TOTP shared secret.
References
| ▼ | URL | Tags |
|---|---|---|
| http://liferay.com | x_refsource_MISC | |
| https://issues.liferay.com/browse/LPE-17131 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T21:55:12.504Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://liferay.com"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://issues.liferay.com/browse/LPE-17131"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Denial-of-service (DoS) vulnerability in the Multi-Factor Authentication module in Liferay DXP 7.3 before fix pack 1 allows remote authenticated attackers to prevent any user from authenticating by (1) enabling Time-based One-time password (TOTP) on behalf of the other user or (2) modifying the other user\u0027s TOTP shared secret."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-05-16T15:14:22",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "http://liferay.com"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://issues.liferay.com/browse/LPE-17131"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2021-29041",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Denial-of-service (DoS) vulnerability in the Multi-Factor Authentication module in Liferay DXP 7.3 before fix pack 1 allows remote authenticated attackers to prevent any user from authenticating by (1) enabling Time-based One-time password (TOTP) on behalf of the other user or (2) modifying the other user\u0027s TOTP shared secret."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://liferay.com",
"refsource": "MISC",
"url": "http://liferay.com"
},
{
"name": "https://issues.liferay.com/browse/LPE-17131",
"refsource": "MISC",
"url": "https://issues.liferay.com/browse/LPE-17131"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2021-29041",
"datePublished": "2021-05-16T15:14:22",
"dateReserved": "2021-03-22T00:00:00",
"dateUpdated": "2024-08-03T21:55:12.504Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2021-33336
Vulnerability from cvelistv5
Published
2021-08-04 12:53
Modified
2024-08-03 23:50
Severity ?
EPSS score ?
Summary
Cross-site scripting (XSS) vulnerability in the Journal module's add article menu in Liferay Portal 7.3.0 through 7.3.3, and Liferay DXP 7.1 fix pack 18, and 7.2 fix pack 5 through 7, allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_journal_web_portlet_JournalPortlet_name parameter.
References
| ▼ | URL | Tags |
|---|---|---|
| https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2021-33336-stored-xss-with-structure-name | x_refsource_CONFIRM | |
| https://issues.liferay.com/browse/LPE-17078 | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T23:50:41.585Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2021-33336-stored-xss-with-structure-name"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://issues.liferay.com/browse/LPE-17078"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in the Journal module\u0027s add article menu in Liferay Portal 7.3.0 through 7.3.3, and Liferay DXP 7.1 fix pack 18, and 7.2 fix pack 5 through 7, allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_journal_web_portlet_JournalPortlet_name parameter."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-08-04T12:53:41",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2021-33336-stored-xss-with-structure-name"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://issues.liferay.com/browse/LPE-17078"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2021-33336",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in the Journal module\u0027s add article menu in Liferay Portal 7.3.0 through 7.3.3, and Liferay DXP 7.1 fix pack 18, and 7.2 fix pack 5 through 7, allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_journal_web_portlet_JournalPortlet_name parameter."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2021-33336-stored-xss-with-structure-name",
"refsource": "CONFIRM",
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2021-33336-stored-xss-with-structure-name"
},
{
"name": "https://issues.liferay.com/browse/LPE-17078",
"refsource": "CONFIRM",
"url": "https://issues.liferay.com/browse/LPE-17078"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2021-33336",
"datePublished": "2021-08-04T12:53:41",
"dateReserved": "2021-05-20T00:00:00",
"dateUpdated": "2024-08-03T23:50:41.585Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2023-35030
Vulnerability from cvelistv5
Published
2023-06-15 04:06
Modified
2024-10-22 15:51
Severity ?
EPSS score ?
Summary
Cross-site request forgery (CSRF) vulnerability in the Layout module's SEO configuration in Liferay Portal 7.4.3.70 through 7.4.3.76, and Liferay DXP 7.4 update 70 through 76 allows remote attackers to execute arbitrary code in the scripting console via the `_com_liferay_layout_admin_web_portlet_GroupPagesPortlet_backURL` parameter.
References
Impacted products
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T16:17:04.236Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-35030"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-35030",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-10-22T15:48:29.662822Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-10-22T15:51:16.440Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Portal",
"vendor": "Liferay",
"versions": [
{
"lessThanOrEqual": "7.4.3.76",
"status": "affected",
"version": "7.4.3.70",
"versionType": "maven"
}
]
},
{
"defaultStatus": "unaffected",
"product": "DXP",
"vendor": "Liferay",
"versions": [
{
"lessThanOrEqual": "7.4.13.u76",
"status": "affected",
"version": "7.4.13.u70",
"versionType": "maven"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"user": "00000000-0000-4000-9000-000000000000",
"value": "Henrik Bayer (NDIx)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Cross-site request forgery (CSRF) vulnerability in the Layout module\u0027s SEO configuration in Liferay Portal 7.4.3.70 through 7.4.3.76, and Liferay DXP 7.4 update 70 through 76 allows remote attackers to execute arbitrary code in the scripting console via the `_com_liferay_layout_admin_web_portlet_GroupPagesPortlet_backURL` parameter."
}
],
"value": "Cross-site request forgery (CSRF) vulnerability in the Layout module\u0027s SEO configuration in Liferay Portal 7.4.3.70 through 7.4.3.76, and Liferay DXP 7.4 update 70 through 76 allows remote attackers to execute arbitrary code in the scripting console via the `_com_liferay_layout_admin_web_portlet_GroupPagesPortlet_backURL` parameter."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-352",
"description": "CWE-352 Cross-Site Request Forgery (CSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-06-15T04:06:36.864Z",
"orgId": "8b54e794-c6f0-462e-9faa-c1001a673ac3",
"shortName": "Liferay"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-35030"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "8b54e794-c6f0-462e-9faa-c1001a673ac3",
"assignerShortName": "Liferay",
"cveId": "CVE-2023-35030",
"datePublished": "2023-06-15T04:06:36.864Z",
"dateReserved": "2023-06-12T01:29:57.068Z",
"dateUpdated": "2024-10-22T15:51:16.440Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2023-3426
Vulnerability from cvelistv5
Published
2023-08-02 09:40
Modified
2024-10-11 14:09
Severity ?
EPSS score ?
Summary
The organization selector in Liferay Portal 7.4.3.81 through 7.4.3.85, and Liferay DXP 7.4 update 81 through 85 does not check user permission, which allows remote authenticated users to obtain a list of all organizations.
References
Impacted products
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T06:55:03.498Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-3426"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-3426",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-10-11T13:02:53.152164Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-10-11T14:09:13.856Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "DXP",
"vendor": "Liferay",
"versions": [
{
"lessThanOrEqual": "7.4.13.u85",
"status": "affected",
"version": "7.4.13.u81",
"versionType": "maven"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Portal",
"vendor": "Liferay",
"versions": [
{
"lessThanOrEqual": "7.4.3.85",
"status": "affected",
"version": "7.4.3.81",
"versionType": "maven"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"user": "00000000-0000-4000-9000-000000000000",
"value": "4rth4s"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The organization selector in Liferay Portal 7.4.3.81 through 7.4.3.85, and Liferay DXP 7.4 update 81 through 85 does not check user permission, which allows remote authenticated users to obtain a list of all organizations."
}
],
"value": "The organization selector in Liferay Portal 7.4.3.81 through 7.4.3.85, and Liferay DXP 7.4 update 81 through 85 does not check user permission, which allows remote authenticated users to obtain a list of all organizations."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-425",
"description": "CWE-425 Direct Request (\u0027Forced Browsing\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-10-02T15:24:59.097Z",
"orgId": "8b54e794-c6f0-462e-9faa-c1001a673ac3",
"shortName": "Liferay"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-3426"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "8b54e794-c6f0-462e-9faa-c1001a673ac3",
"assignerShortName": "Liferay",
"cveId": "CVE-2023-3426",
"datePublished": "2023-08-02T09:40:28.090Z",
"dateReserved": "2023-06-27T05:43:01.235Z",
"dateUpdated": "2024-10-11T14:09:13.856Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2024-25609
Vulnerability from cvelistv5
Published
2024-02-20 09:37
Modified
2024-08-23 19:19
Severity ?
EPSS score ?
Summary
HtmlUtil.escapeRedirect in Liferay Portal 7.2.0 through 7.4.3.12, and older unsupported versions, and Liferay DXP 7.4 before update 9, 7.3 service pack 3, 7.2 fix pack 15 through 18, and older unsupported versions can be circumvented by using two forward slashes, which allows remote attackers to redirect users to arbitrary external URLs via the (1) 'redirect` parameter (2) `FORWARD_URL` parameter, and (3) others parameters that rely on HtmlUtil.escapeRedirect. This vulnerability is the result of an incomplete fix in CVE-2022-28977.
References
Impacted products
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-01T23:44:09.679Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25609"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-25609",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-08-23T19:18:48.528753Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-08-23T19:19:20.308Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Portal",
"vendor": "Liferay",
"versions": [
{
"lessThanOrEqual": "7.4.3.12",
"status": "affected",
"version": "7.2.0",
"versionType": "maven"
}
]
},
{
"defaultStatus": "unknown",
"product": "DXP",
"vendor": "Liferay",
"versions": [
{
"lessThanOrEqual": "7.4.13.u8",
"status": "affected",
"version": "7.4.13",
"versionType": "maven"
},
{
"status": "affected",
"version": "7.3.10-dxp-3"
},
{
"lessThanOrEqual": "7.2.10-dxp-18",
"status": "affected",
"version": "7.2.10-dxp-15",
"versionType": "maven"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "HtmlUtil.escapeRedirect in Liferay Portal 7.2.0 through 7.4.3.12, and older unsupported versions, and Liferay DXP 7.4 before update 9, 7.3 service pack 3, 7.2 fix pack 15 through 18, and older unsupported versions can be circumvented by using two forward slashes, which allows remote attackers to redirect users to arbitrary external URLs via the (1) \u0027redirect` parameter (2) `FORWARD_URL` parameter, and (3) others parameters that rely on HtmlUtil.escapeRedirect. This vulnerability is the result of an incomplete fix in CVE-2022-28977."
}
],
"value": "HtmlUtil.escapeRedirect in Liferay Portal 7.2.0 through 7.4.3.12, and older unsupported versions, and Liferay DXP 7.4 before update 9, 7.3 service pack 3, 7.2 fix pack 15 through 18, and older unsupported versions can be circumvented by using two forward slashes, which allows remote attackers to redirect users to arbitrary external URLs via the (1) \u0027redirect` parameter (2) `FORWARD_URL` parameter, and (3) others parameters that rely on HtmlUtil.escapeRedirect. This vulnerability is the result of an incomplete fix in CVE-2022-28977."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-601",
"description": "CWE-601 URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-02-20T09:37:55.362Z",
"orgId": "8b54e794-c6f0-462e-9faa-c1001a673ac3",
"shortName": "Liferay"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25609"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "8b54e794-c6f0-462e-9faa-c1001a673ac3",
"assignerShortName": "Liferay",
"cveId": "CVE-2024-25609",
"datePublished": "2024-02-20T09:37:55.362Z",
"dateReserved": "2024-02-08T13:57:11.426Z",
"dateUpdated": "2024-08-23T19:19:20.308Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2021-33330
Vulnerability from cvelistv5
Published
2021-08-03 18:50
Modified
2024-08-03 23:50
Severity ?
EPSS score ?
Summary
Liferay Portal 7.2.0 through 7.3.2, and Liferay DXP 7.2 before fix pack 9, allows access to Cross-origin resource sharing (CORS) protected resources if the user is only authenticated using the portal session authentication, which allows remote attackers to obtain sensitive information including the targeted user’s email address and current CSRF token.
References
| ▼ | URL | Tags |
|---|---|---|
| https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120747720 | x_refsource_CONFIRM | |
| https://issues.liferay.com/browse/LPE-17127 | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T23:50:41.585Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120747720"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://issues.liferay.com/browse/LPE-17127"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Liferay Portal 7.2.0 through 7.3.2, and Liferay DXP 7.2 before fix pack 9, allows access to Cross-origin resource sharing (CORS) protected resources if the user is only authenticated using the portal session authentication, which allows remote attackers to obtain sensitive information including the targeted user\u2019s email address and current CSRF token."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-08-03T18:50:43",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120747720"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://issues.liferay.com/browse/LPE-17127"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2021-33330",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Liferay Portal 7.2.0 through 7.3.2, and Liferay DXP 7.2 before fix pack 9, allows access to Cross-origin resource sharing (CORS) protected resources if the user is only authenticated using the portal session authentication, which allows remote attackers to obtain sensitive information including the targeted user\u2019s email address and current CSRF token."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120747720",
"refsource": "CONFIRM",
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120747720"
},
{
"name": "https://issues.liferay.com/browse/LPE-17127",
"refsource": "CONFIRM",
"url": "https://issues.liferay.com/browse/LPE-17127"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2021-33330",
"datePublished": "2021-08-03T18:50:43",
"dateReserved": "2021-05-20T00:00:00",
"dateUpdated": "2024-08-03T23:50:41.585Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2020-15840
Vulnerability from cvelistv5
Published
2020-09-24 14:56
Modified
2024-08-04 13:30
Severity ?
EPSS score ?
Summary
In Liferay Portal before 7.3.1, Liferay Portal 6.2 EE, and Liferay DXP 7.2, DXP 7.1 and DXP 7.0, the property 'portlet.resource.id.banned.paths.regexp' can be bypassed with doubled encoded URLs.
References
| ▼ | URL | Tags |
|---|---|---|
| https://portal.liferay.dev/learn/security/known-vulnerabilities | x_refsource_MISC | |
| https://issues.liferay.com/browse/LPE-17046 | x_refsource_CONFIRM | |
| https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/119772204 | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T13:30:22.352Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://issues.liferay.com/browse/LPE-17046"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/119772204"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In Liferay Portal before 7.3.1, Liferay Portal 6.2 EE, and Liferay DXP 7.2, DXP 7.1 and DXP 7.0, the property \u0027portlet.resource.id.banned.paths.regexp\u0027 can be bypassed with doubled encoded URLs."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-09-24T14:56:23",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://issues.liferay.com/browse/LPE-17046"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/119772204"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2020-15840",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "In Liferay Portal before 7.3.1, Liferay Portal 6.2 EE, and Liferay DXP 7.2, DXP 7.1 and DXP 7.0, the property \u0027portlet.resource.id.banned.paths.regexp\u0027 can be bypassed with doubled encoded URLs."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://portal.liferay.dev/learn/security/known-vulnerabilities",
"refsource": "MISC",
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities"
},
{
"name": "https://issues.liferay.com/browse/LPE-17046",
"refsource": "CONFIRM",
"url": "https://issues.liferay.com/browse/LPE-17046"
},
{
"name": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/119772204",
"refsource": "CONFIRM",
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/119772204"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2020-15840",
"datePublished": "2020-09-24T14:56:23",
"dateReserved": "2020-07-20T00:00:00",
"dateUpdated": "2024-08-04T13:30:22.352Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2024-26269
Vulnerability from cvelistv5
Published
2024-02-21 02:39
Modified
2024-08-02 00:07
Severity ?
EPSS score ?
Summary
Cross-site scripting (XSS) vulnerability in the Frontend JS module's portlet.js in Liferay Portal 7.2.0 through 7.4.3.37, and Liferay DXP 7.4 before update 38, 7.3 before update 11, 7.2 before fix pack 20, and older unsupported versions allows remote attackers to inject arbitrary web script or HTML via the anchor (hash) part of a URL.
References
Impacted products
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:liferay:portal:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "portal",
"vendor": "liferay",
"versions": [
{
"lessThanOrEqual": "7.4.3.37",
"status": "affected",
"version": "7.2.0",
"versionType": "maven"
}
]
},
{
"cpes": [
"cpe:2.3:a:liferay:dxp:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "dxp",
"vendor": "liferay",
"versions": [
{
"lessThanOrEqual": "7.4.13.u37",
"status": "affected",
"version": "7.4.13",
"versionType": "maven"
},
{
"lessThanOrEqual": "7.3.10.u10",
"status": "affected",
"version": "7.3.10",
"versionType": "maven"
},
{
"lessThanOrEqual": "7.2.10-dxp-19",
"status": "affected",
"version": "7.2.10",
"versionType": "maven"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-26269",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-02-21T16:16:54.489514Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-07-26T16:43:03.198Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T00:07:19.085Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-26269"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Portal",
"vendor": "Liferay",
"versions": [
{
"lessThanOrEqual": "7.4.3.37",
"status": "affected",
"version": "7.2.0",
"versionType": "maven"
}
]
},
{
"defaultStatus": "unknown",
"product": "DXP",
"vendor": "Liferay",
"versions": [
{
"lessThanOrEqual": "7.4.13.u37",
"status": "affected",
"version": "7.4.13",
"versionType": "maven"
},
{
"lessThanOrEqual": "7.3.10.u10",
"status": "affected",
"version": "7.3.10",
"versionType": "maven"
},
{
"lessThanOrEqual": "7.2.10-dxp-19",
"status": "affected",
"version": "7.2.10",
"versionType": "maven"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Cross-site scripting (XSS) vulnerability in the Frontend JS module\u0027s portlet.js in Liferay Portal 7.2.0 through 7.4.3.37, and Liferay DXP 7.4 before update 38, 7.3 before update 11, 7.2 before fix pack 20, and older unsupported versions allows remote attackers to inject arbitrary web script or HTML via the anchor (hash) part of a URL."
}
],
"value": "Cross-site scripting (XSS) vulnerability in the Frontend JS module\u0027s portlet.js in Liferay Portal 7.2.0 through 7.4.3.37, and Liferay DXP 7.4 before update 38, 7.3 before update 11, 7.2 before fix pack 20, and older unsupported versions allows remote attackers to inject arbitrary web script or HTML via the anchor (hash) part of a URL."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.6,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-02-21T02:39:41.806Z",
"orgId": "8b54e794-c6f0-462e-9faa-c1001a673ac3",
"shortName": "Liferay"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-26269"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "8b54e794-c6f0-462e-9faa-c1001a673ac3",
"assignerShortName": "Liferay",
"cveId": "CVE-2024-26269",
"datePublished": "2024-02-21T02:39:41.806Z",
"dateReserved": "2024-02-15T07:44:36.776Z",
"dateUpdated": "2024-08-02T00:07:19.085Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2023-42497
Vulnerability from cvelistv5
Published
2023-10-17 07:56
Modified
2024-09-13 16:32
Severity ?
EPSS score ?
Summary
Reflected cross-site scripting (XSS) vulnerability on the Export for Translation page in Liferay Portal 7.4.3.4 through 7.4.3.85, and Liferay DXP 7.4 before update 86 allows remote attackers to inject arbitrary web script or HTML via the `_com_liferay_translation_web_internal_portlet_TranslationPortlet_redirect` parameter.
References
Impacted products
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T19:23:38.911Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-42497"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-42497",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-13T16:32:09.323926Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-13T16:32:16.701Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "DXP",
"vendor": "Liferay",
"versions": [
{
"lessThanOrEqual": "7.4.13.u85",
"status": "affected",
"version": "7.4.13",
"versionType": "maven"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Portal",
"vendor": "Liferay",
"versions": [
{
"lessThanOrEqual": "7.4.3.85",
"status": "affected",
"version": "7.4.3.4",
"versionType": "maven"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"user": "00000000-0000-4000-9000-000000000000",
"value": "Amin ACHOUR"
}
],
"datePublic": "2023-10-17T07:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Reflected cross-site scripting (XSS) vulnerability on the Export for Translation page in Liferay Portal 7.4.3.4 through 7.4.3.85, and Liferay DXP 7.4 before update 86 allows remote attackers to inject arbitrary web script or HTML via the `_com_liferay_translation_web_internal_portlet_TranslationPortlet_redirect` parameter.\u003cbr\u003e"
}
],
"value": "Reflected cross-site scripting (XSS) vulnerability on the Export for Translation page in Liferay Portal 7.4.3.4 through 7.4.3.85, and Liferay DXP 7.4 before update 86 allows remote attackers to inject arbitrary web script or HTML via the `_com_liferay_translation_web_internal_portlet_TranslationPortlet_redirect` parameter.\n"
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.6,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-10-17T07:56:20.696Z",
"orgId": "8b54e794-c6f0-462e-9faa-c1001a673ac3",
"shortName": "Liferay"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-42497"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "8b54e794-c6f0-462e-9faa-c1001a673ac3",
"assignerShortName": "Liferay",
"cveId": "CVE-2023-42497",
"datePublished": "2023-10-17T07:56:20.696Z",
"dateReserved": "2023-09-11T08:54:24.312Z",
"dateUpdated": "2024-09-13T16:32:16.701Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2023-3193
Vulnerability from cvelistv5
Published
2023-06-15 03:47
Modified
2024-10-22 15:42
Severity ?
EPSS score ?
Summary
Cross-site scripting (XSS) vulnerability in the Layout module's SEO configuration in Liferay Portal 7.4.3.70 through 7.4.3.73, and Liferay DXP 7.4 update 70 through 73 allows remote attackers to inject arbitrary web script or HTML via the `_com_liferay_layout_admin_web_portlet_GroupPagesPortlet_backURL` parameter.
References
Impacted products
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T06:48:07.984Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-3193"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-3193",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-10-22T15:42:06.456978Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-10-22T15:42:25.535Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Portal",
"vendor": "Liferay",
"versions": [
{
"lessThanOrEqual": "7.4.3.73",
"status": "affected",
"version": "7.4.3.70",
"versionType": "maven"
}
]
},
{
"defaultStatus": "unaffected",
"product": "DXP",
"vendor": "Liferay",
"versions": [
{
"lessThanOrEqual": "7.4.13.u73",
"status": "affected",
"version": "7.4.13.u70",
"versionType": "maven"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"user": "00000000-0000-4000-9000-000000000000",
"value": "Henrik Bayer (NDIx)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Cross-site scripting (XSS) vulnerability in the Layout module\u0027s SEO configuration in Liferay Portal 7.4.3.70 through 7.4.3.73, and Liferay DXP 7.4 update 70 through 73 allows remote attackers to inject arbitrary web script or HTML via the `_com_liferay_layout_admin_web_portlet_GroupPagesPortlet_backURL` parameter."
}
],
"value": "Cross-site scripting (XSS) vulnerability in the Layout module\u0027s SEO configuration in Liferay Portal 7.4.3.70 through 7.4.3.73, and Liferay DXP 7.4 update 70 through 73 allows remote attackers to inject arbitrary web script or HTML via the `_com_liferay_layout_admin_web_portlet_GroupPagesPortlet_backURL` parameter."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-06-15T03:47:57.663Z",
"orgId": "8b54e794-c6f0-462e-9faa-c1001a673ac3",
"shortName": "Liferay"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-3193"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "8b54e794-c6f0-462e-9faa-c1001a673ac3",
"assignerShortName": "Liferay",
"cveId": "CVE-2023-3193",
"datePublished": "2023-06-15T03:47:57.663Z",
"dateReserved": "2023-06-12T01:31:14.692Z",
"dateUpdated": "2024-10-22T15:42:25.535Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2021-29040
Vulnerability from cvelistv5
Published
2021-05-16 15:03
Modified
2024-08-03 21:55
Severity ?
EPSS score ?
Summary
The JSON web services in Liferay Portal 7.3.4 and earlier, and Liferay DXP 7.0 before fix pack 97, 7.1 before fix pack 20 and 7.2 before fix pack 10 may provide overly verbose error messages, which allows remote attackers to use the contents of error messages to help launch another, more focused attacks via crafted inputs.
References
| ▼ | URL | Tags |
|---|---|---|
| http://liferay.com | x_refsource_MISC | |
| https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120743429 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T21:55:12.496Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://liferay.com"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120743429"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The JSON web services in Liferay Portal 7.3.4 and earlier, and Liferay DXP 7.0 before fix pack 97, 7.1 before fix pack 20 and 7.2 before fix pack 10 may provide overly verbose error messages, which allows remote attackers to use the contents of error messages to help launch another, more focused attacks via crafted inputs."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-05-16T15:03:16",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "http://liferay.com"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120743429"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2021-29040",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The JSON web services in Liferay Portal 7.3.4 and earlier, and Liferay DXP 7.0 before fix pack 97, 7.1 before fix pack 20 and 7.2 before fix pack 10 may provide overly verbose error messages, which allows remote attackers to use the contents of error messages to help launch another, more focused attacks via crafted inputs."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://liferay.com",
"refsource": "MISC",
"url": "http://liferay.com"
},
{
"name": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120743429",
"refsource": "MISC",
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120743429"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2021-29040",
"datePublished": "2021-05-16T15:03:16",
"dateReserved": "2021-03-22T00:00:00",
"dateUpdated": "2024-08-03T21:55:12.496Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2021-33338
Vulnerability from cvelistv5
Published
2021-08-04 13:07
Modified
2024-08-03 23:50
Severity ?
EPSS score ?
Summary
The Layout module in Liferay Portal 7.1.0 through 7.3.2, and Liferay DXP 7.1 before fix pack 19, and 7.2 before fix pack 6, exposes the CSRF token in URLs, which allows man-in-the-middle attackers to obtain the token and conduct Cross-Site Request Forgery (CSRF) attacks via the p_auth parameter.
References
| ▼ | URL | Tags |
|---|---|---|
| https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120748276 | x_refsource_CONFIRM | |
| https://issues.liferay.com/browse/LPE-17030 | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T23:50:42.556Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120748276"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://issues.liferay.com/browse/LPE-17030"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The Layout module in Liferay Portal 7.1.0 through 7.3.2, and Liferay DXP 7.1 before fix pack 19, and 7.2 before fix pack 6, exposes the CSRF token in URLs, which allows man-in-the-middle attackers to obtain the token and conduct Cross-Site Request Forgery (CSRF) attacks via the p_auth parameter."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-08-04T13:07:26",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120748276"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://issues.liferay.com/browse/LPE-17030"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2021-33338",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The Layout module in Liferay Portal 7.1.0 through 7.3.2, and Liferay DXP 7.1 before fix pack 19, and 7.2 before fix pack 6, exposes the CSRF token in URLs, which allows man-in-the-middle attackers to obtain the token and conduct Cross-Site Request Forgery (CSRF) attacks via the p_auth parameter."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120748276",
"refsource": "CONFIRM",
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120748276"
},
{
"name": "https://issues.liferay.com/browse/LPE-17030",
"refsource": "CONFIRM",
"url": "https://issues.liferay.com/browse/LPE-17030"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2021-33338",
"datePublished": "2021-08-04T13:07:26",
"dateReserved": "2021-05-20T00:00:00",
"dateUpdated": "2024-08-03T23:50:42.556Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2021-33327
Vulnerability from cvelistv5
Published
2021-08-03 18:46
Modified
2024-08-03 23:50
Severity ?
EPSS score ?
Summary
The Portlet Configuration module in Liferay Portal 7.2.0 through 7.3.3, and Liferay DXP 7.0 fix pack pack 93 and 94, 7.1 fix pack 18, and 7.2 before fix pack 8, does not properly check user permission, which allows remote authenticated users to view the Guest and User role even if "Role Visibility" is enabled.
References
| ▼ | URL | Tags |
|---|---|---|
| https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120747840 | x_refsource_CONFIRM | |
| https://issues.liferay.com/browse/LPE-17075 | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T23:50:41.434Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120747840"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://issues.liferay.com/browse/LPE-17075"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The Portlet Configuration module in Liferay Portal 7.2.0 through 7.3.3, and Liferay DXP 7.0 fix pack pack 93 and 94, 7.1 fix pack 18, and 7.2 before fix pack 8, does not properly check user permission, which allows remote authenticated users to view the Guest and User role even if \"Role Visibility\" is enabled."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-08-03T18:46:02",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120747840"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://issues.liferay.com/browse/LPE-17075"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2021-33327",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The Portlet Configuration module in Liferay Portal 7.2.0 through 7.3.3, and Liferay DXP 7.0 fix pack pack 93 and 94, 7.1 fix pack 18, and 7.2 before fix pack 8, does not properly check user permission, which allows remote authenticated users to view the Guest and User role even if \"Role Visibility\" is enabled."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120747840",
"refsource": "CONFIRM",
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120747840"
},
{
"name": "https://issues.liferay.com/browse/LPE-17075",
"refsource": "CONFIRM",
"url": "https://issues.liferay.com/browse/LPE-17075"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2021-33327",
"datePublished": "2021-08-03T18:46:02",
"dateReserved": "2021-05-20T00:00:00",
"dateUpdated": "2024-08-03T23:50:41.434Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2022-38901
Vulnerability from cvelistv5
Published
2022-10-19 00:00
Modified
2024-08-03 11:02
Severity ?
EPSS score ?
Summary
A Cross-site scripting (XSS) vulnerability in the Document and Media module - file upload functionality in Liferay Digital Experience Platform 7.3.10 SP3 allows remote attackers to inject arbitrary JS script or HTML into the description field of uploaded svg file.
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T11:02:14.616Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "http://liferay.com"
},
{
"tags": [
"x_transferred"
],
"url": "https://drive.proton.me/urls/D27RQ14NGW#b71d8XrBl2Mu"
},
{
"tags": [
"x_transferred"
],
"url": "https://www.offensity.com/en/blog/authenticated-persistent-xss-in-liferay-dxp-cms-cve-2022-38901-and-cve-2022-38902/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A Cross-site scripting (XSS) vulnerability in the Document and Media module - file upload functionality in Liferay Digital Experience Platform 7.3.10 SP3 allows remote attackers to inject arbitrary JS script or HTML into the description field of uploaded svg file."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-10-19T00:00:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "http://liferay.com"
},
{
"url": "https://drive.proton.me/urls/D27RQ14NGW#b71d8XrBl2Mu"
},
{
"url": "https://www.offensity.com/en/blog/authenticated-persistent-xss-in-liferay-dxp-cms-cve-2022-38901-and-cve-2022-38902/"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2022-38901",
"datePublished": "2022-10-19T00:00:00",
"dateReserved": "2022-08-29T00:00:00",
"dateUpdated": "2024-08-03T11:02:14.616Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2021-33325
Vulnerability from cvelistv5
Published
2021-08-03 18:33
Modified
2024-08-03 23:50
Severity ?
EPSS score ?
Summary
The Portal Workflow module in Liferay Portal 7.3.2 and earlier, and Liferay DXP 7.0 before fix pack 93, 7.1 before fix pack 19, and 7.2 before fix pack 7, user's clear text passwords are stored in the database if workflow is enabled for user creation, which allows attackers with access to the database to obtain a user's password.
References
| ▼ | URL | Tags |
|---|---|---|
| https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120748389 | x_refsource_CONFIRM | |
| https://issues.liferay.com/browse/LPE-17042 | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T23:50:42.278Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120748389"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://issues.liferay.com/browse/LPE-17042"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The Portal Workflow module in Liferay Portal 7.3.2 and earlier, and Liferay DXP 7.0 before fix pack 93, 7.1 before fix pack 19, and 7.2 before fix pack 7, user\u0027s clear text passwords are stored in the database if workflow is enabled for user creation, which allows attackers with access to the database to obtain a user\u0027s password."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-08-03T18:33:34",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120748389"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://issues.liferay.com/browse/LPE-17042"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2021-33325",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The Portal Workflow module in Liferay Portal 7.3.2 and earlier, and Liferay DXP 7.0 before fix pack 93, 7.1 before fix pack 19, and 7.2 before fix pack 7, user\u0027s clear text passwords are stored in the database if workflow is enabled for user creation, which allows attackers with access to the database to obtain a user\u0027s password."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120748389",
"refsource": "CONFIRM",
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120748389"
},
{
"name": "https://issues.liferay.com/browse/LPE-17042",
"refsource": "CONFIRM",
"url": "https://issues.liferay.com/browse/LPE-17042"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2021-33325",
"datePublished": "2021-08-03T18:33:34",
"dateReserved": "2021-05-20T00:00:00",
"dateUpdated": "2024-08-03T23:50:42.278Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2021-33321
Vulnerability from cvelistv5
Published
2021-08-03 18:12
Modified
2024-08-03 23:50
Severity ?
EPSS score ?
Summary
Insecure default configuration in Liferay Portal 6.2.3 through 7.3.2, and Liferay DXP before 7.3, allows remote attackers to enumerate user email address via the forgot password functionality. The portal.property login.secure.forgot.password should be defaulted to true.
References
| ▼ | URL | Tags |
|---|---|---|
| https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120748055 | x_refsource_CONFIRM | |
| https://help.liferay.com/hc/en-us/articles/360050785632 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T23:50:41.580Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120748055"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://help.liferay.com/hc/en-us/articles/360050785632"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Insecure default configuration in Liferay Portal 6.2.3 through 7.3.2, and Liferay DXP before 7.3, allows remote attackers to enumerate user email address via the forgot password functionality. The portal.property login.secure.forgot.password should be defaulted to true."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-08-03T18:12:26",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120748055"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://help.liferay.com/hc/en-us/articles/360050785632"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2021-33321",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Insecure default configuration in Liferay Portal 6.2.3 through 7.3.2, and Liferay DXP before 7.3, allows remote attackers to enumerate user email address via the forgot password functionality. The portal.property login.secure.forgot.password should be defaulted to true."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120748055",
"refsource": "CONFIRM",
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120748055"
},
{
"name": "https://help.liferay.com/hc/en-us/articles/360050785632",
"refsource": "MISC",
"url": "https://help.liferay.com/hc/en-us/articles/360050785632"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2021-33321",
"datePublished": "2021-08-03T18:12:26",
"dateReserved": "2021-05-20T00:00:00",
"dateUpdated": "2024-08-03T23:50:41.580Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2024-25601
Vulnerability from cvelistv5
Published
2024-02-21 01:54
Modified
2024-08-01 23:44
Severity ?
EPSS score ?
Summary
Stored cross-site scripting (XSS) vulnerability in Expando module's geolocation custom fields in Liferay Portal 7.2.0 through 7.4.2, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 17, and older unsupported versions allows remote authenticated users to inject arbitrary web script or HTML via a crafted payload injected into the name text field of a geolocation custom field.
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-25601",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-02-21T14:15:10.305868Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-07-05T17:21:48.975Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-01T23:44:09.660Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25601"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Portal",
"vendor": "Liferay",
"versions": [
{
"lessThanOrEqual": "7.4.2",
"status": "affected",
"version": "7.2.0",
"versionType": "maven"
}
]
},
{
"defaultStatus": "unknown",
"product": "DXP",
"vendor": "Liferay",
"versions": [
{
"lessThanOrEqual": "7.3.10-dxp-2",
"status": "affected",
"version": "7.3.10",
"versionType": "maven"
},
{
"lessThanOrEqual": "7.2.10-dxp-16",
"status": "affected",
"version": "7.2.10",
"versionType": "maven"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Stored cross-site scripting (XSS) vulnerability in Expando module\u0027s geolocation custom fields in Liferay Portal 7.2.0 through 7.4.2, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 17, and older unsupported versions allows remote authenticated users to inject arbitrary web script or HTML via a crafted payload injected into the name text field of a geolocation custom field."
}
],
"value": "Stored cross-site scripting (XSS) vulnerability in Expando module\u0027s geolocation custom fields in Liferay Portal 7.2.0 through 7.4.2, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 17, and older unsupported versions allows remote authenticated users to inject arbitrary web script or HTML via a crafted payload injected into the name text field of a geolocation custom field."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-02-21T01:54:47.283Z",
"orgId": "8b54e794-c6f0-462e-9faa-c1001a673ac3",
"shortName": "Liferay"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25601"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "8b54e794-c6f0-462e-9faa-c1001a673ac3",
"assignerShortName": "Liferay",
"cveId": "CVE-2024-25601",
"datePublished": "2024-02-21T01:54:47.283Z",
"dateReserved": "2024-02-08T13:57:11.425Z",
"dateUpdated": "2024-08-01T23:44:09.660Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2024-25146
Vulnerability from cvelistv5
Published
2024-02-08 03:36
Modified
2024-08-01 23:36
Severity ?
EPSS score ?
Summary
Liferay Portal 7.2.0 through 7.4.1, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 18, and older unsupported versions returns with different responses depending on whether a site does not exist or if the user does not have permission to access the site, which allows remote attackers to discover the existence of sites by enumerating URLs. This vulnerability occurs if locale.prepend.friendly.url.style=2 and if a custom 404 page is used.
References
Impacted products
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-01T23:36:21.804Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25146"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Portal",
"vendor": "Liferay",
"versions": [
{
"lessThanOrEqual": "7.4.1",
"status": "affected",
"version": "7.2.0",
"versionType": "maven"
}
]
},
{
"defaultStatus": "unknown",
"product": "DXP",
"vendor": "Liferay",
"versions": [
{
"lessThanOrEqual": "7.3.10-dxp-2",
"status": "affected",
"version": "7.3.10",
"versionType": "maven"
},
{
"lessThanOrEqual": "7.2.10-dxp-17",
"status": "affected",
"version": "7.2.10",
"versionType": "maven"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Liferay Portal 7.2.0 through 7.4.1, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 18, and older unsupported versions returns with different responses depending on whether a site does not exist or if the user does not have permission to access the site, which allows remote attackers to discover the existence of sites by enumerating URLs. This vulnerability occurs if locale.prepend.friendly.url.style=2 and if a custom 404 page is used."
}
],
"value": "Liferay Portal 7.2.0 through 7.4.1, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 18, and older unsupported versions returns with different responses depending on whether a site does not exist or if the user does not have permission to access the site, which allows remote attackers to discover the existence of sites by enumerating URLs. This vulnerability occurs if locale.prepend.friendly.url.style=2 and if a custom 404 page is used."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-204",
"description": "CWE-204 Observable Response Discrepancy",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-02-08T03:36:07.512Z",
"orgId": "8b54e794-c6f0-462e-9faa-c1001a673ac3",
"shortName": "Liferay"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25146"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "8b54e794-c6f0-462e-9faa-c1001a673ac3",
"assignerShortName": "Liferay",
"cveId": "CVE-2024-25146",
"datePublished": "2024-02-08T03:36:07.512Z",
"dateReserved": "2024-02-06T10:32:42.567Z",
"dateUpdated": "2024-08-01T23:36:21.804Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2021-33320
Vulnerability from cvelistv5
Published
2021-08-03 18:09
Modified
2024-08-03 23:50
Severity ?
EPSS score ?
Summary
The Flags module in Liferay Portal 7.3.1 and earlier, and Liferay DXP 7.0 before fix pack 96, 7.1 before fix pack 20, and 7.2 before fix pack 5, does not limit the rate at which content can be flagged as inappropriate, which allows remote authenticated users to spam the site administrator with emails
References
| ▼ | URL | Tags |
|---|---|---|
| https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120747590 | x_refsource_CONFIRM | |
| https://issues.liferay.com/browse/LPE-17007 | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T23:50:41.556Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120747590"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://issues.liferay.com/browse/LPE-17007"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The Flags module in Liferay Portal 7.3.1 and earlier, and Liferay DXP 7.0 before fix pack 96, 7.1 before fix pack 20, and 7.2 before fix pack 5, does not limit the rate at which content can be flagged as inappropriate, which allows remote authenticated users to spam the site administrator with emails"
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-08-03T18:09:17",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120747590"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://issues.liferay.com/browse/LPE-17007"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2021-33320",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The Flags module in Liferay Portal 7.3.1 and earlier, and Liferay DXP 7.0 before fix pack 96, 7.1 before fix pack 20, and 7.2 before fix pack 5, does not limit the rate at which content can be flagged as inappropriate, which allows remote authenticated users to spam the site administrator with emails"
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120747590",
"refsource": "CONFIRM",
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120747590"
},
{
"name": "https://issues.liferay.com/browse/LPE-17007",
"refsource": "CONFIRM",
"url": "https://issues.liferay.com/browse/LPE-17007"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2021-33320",
"datePublished": "2021-08-03T18:09:17",
"dateReserved": "2021-05-20T00:00:00",
"dateUpdated": "2024-08-03T23:50:41.556Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2022-42118
Vulnerability from cvelistv5
Published
2022-11-15 00:00
Modified
2024-08-03 13:03
Severity ?
EPSS score ?
Summary
A Cross-site scripting (XSS) vulnerability in the Portal Search module in Liferay Portal 7.1.0 through 7.4.2, and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 15, and 7.3 before service pack 3 allows remote attackers to inject arbitrary web script or HTML via the `tag` parameter.
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T13:03:45.899Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "http://liferay.com"
},
{
"tags": [
"x_transferred"
],
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42118"
},
{
"tags": [
"x_transferred"
],
"url": "https://issues.liferay.com/browse/LPE-17342"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A Cross-site scripting (XSS) vulnerability in the Portal Search module in Liferay Portal 7.1.0 through 7.4.2, and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 15, and 7.3 before service pack 3 allows remote attackers to inject arbitrary web script or HTML via the `tag` parameter."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-11-15T00:00:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "http://liferay.com"
},
{
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42118"
},
{
"url": "https://issues.liferay.com/browse/LPE-17342"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2022-42118",
"datePublished": "2022-11-15T00:00:00",
"dateReserved": "2022-10-03T00:00:00",
"dateUpdated": "2024-08-03T13:03:45.899Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2020-15842
Vulnerability from cvelistv5
Published
2020-07-20 01:06
Modified
2024-08-04 13:30
Severity ?
EPSS score ?
Summary
Liferay Portal before 7.3.0, and Liferay DXP 7.0 before fix pack 90, 7.1 before fix pack 17, and 7.2 before fix pack 5, allows man-in-the-middle attackers to execute arbitrary code via crafted serialized payloads, because of insecure deserialization.
References
| ▼ | URL | Tags |
|---|---|---|
| https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/119317427 | x_refsource_MISC | |
| https://issues.liferay.com/browse/LPE-16963 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T13:30:22.940Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/119317427"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://issues.liferay.com/browse/LPE-16963"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Liferay Portal before 7.3.0, and Liferay DXP 7.0 before fix pack 90, 7.1 before fix pack 17, and 7.2 before fix pack 5, allows man-in-the-middle attackers to execute arbitrary code via crafted serialized payloads, because of insecure deserialization."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AC:H/AV:N/A:H/C:H/I:H/PR:N/S:U/UI:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-07-20T01:06:54",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/119317427"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://issues.liferay.com/browse/LPE-16963"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2020-15842",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Liferay Portal before 7.3.0, and Liferay DXP 7.0 before fix pack 90, 7.1 before fix pack 17, and 7.2 before fix pack 5, allows man-in-the-middle attackers to execute arbitrary code via crafted serialized payloads, because of insecure deserialization."
}
]
},
"impact": {
"cvss": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AC:H/AV:N/A:H/C:H/I:H/PR:N/S:U/UI:N",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/119317427",
"refsource": "MISC",
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/119317427"
},
{
"name": "https://issues.liferay.com/browse/LPE-16963",
"refsource": "MISC",
"url": "https://issues.liferay.com/browse/LPE-16963"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2020-15842",
"datePublished": "2020-07-20T01:06:54",
"dateReserved": "2020-07-20T00:00:00",
"dateUpdated": "2024-08-04T13:30:22.940Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2024-38002
Vulnerability from cvelistv5
Published
2024-10-22 15:12
Modified
2024-10-22 15:22
Severity ?
EPSS score ?
Summary
The workflow component in Liferay Portal 7.3.2 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, 7.4 GA through update 92 and 7.3 GA through update 36 does not properly check user permissions before updating a workflow definition, which allows remote authenticated users to modify workflow definitions and execute arbitrary code (RCE) via the headless API.
References
Impacted products
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:liferay:portal:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "portal",
"vendor": "liferay",
"versions": [
{
"lessThanOrEqual": "7.4.3.111",
"status": "affected",
"version": "7.4.0",
"versionType": "maven"
},
{
"lessThanOrEqual": "7.3.7",
"status": "affected",
"version": "7.3.2",
"versionType": "maven"
}
]
},
{
"cpes": [
"cpe:2.3:a:liferay:dxp:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "dxp",
"vendor": "liferay",
"versions": [
{
"lessThanOrEqual": "2023.q4.5",
"status": "affected",
"version": "2023.q4.0",
"versionType": "maven"
},
{
"lessThanOrEqual": "2023.q3.8",
"status": "affected",
"version": "2023.q3.1",
"versionType": "maven"
},
{
"status": "affected",
"version": "7.4"
},
{
"status": "affected",
"version": "7.3"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-38002",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-10-22T15:21:03.278642Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-10-22T15:22:55.078Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Portal",
"vendor": "Liferay",
"versions": [
{
"lessThanOrEqual": "7.3.7",
"status": "affected",
"version": "7.3.2",
"versionType": "maven"
},
{
"lessThanOrEqual": "7.4.3.111",
"status": "affected",
"version": "7.4.0",
"versionType": "maven"
}
]
},
{
"defaultStatus": "unaffected",
"product": "DXP",
"vendor": "Liferay",
"versions": [
{
"lessThanOrEqual": "7.3.10-u36",
"status": "affected",
"version": "7.3.10",
"versionType": "maven"
},
{
"lessThanOrEqual": "7.4.13-u92",
"status": "affected",
"version": "7.4.13",
"versionType": "maven"
},
{
"lessThanOrEqual": "2023.Q3.8",
"status": "affected",
"version": "2023.Q3.1",
"versionType": "maven"
},
{
"lessThanOrEqual": "2023.Q4.5",
"status": "affected",
"version": "2023.Q4.0",
"versionType": "maven"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The workflow component in Liferay Portal 7.3.2 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, 7.4 GA through update 92 and 7.3 GA through update 36 does not properly check user permissions before updating a workflow definition, which allows remote authenticated users to modify workflow definitions and execute arbitrary code (RCE) via the headless API."
}
],
"value": "The workflow component in Liferay Portal 7.3.2 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, 7.4 GA through update 92 and 7.3 GA through update 36 does not properly check user permissions before updating a workflow definition, which allows remote authenticated users to modify workflow definitions and execute arbitrary code (RCE) via the headless API."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863 Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-10-22T15:12:42.223Z",
"orgId": "8b54e794-c6f0-462e-9faa-c1001a673ac3",
"shortName": "Liferay"
},
"references": [
{
"url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2024-38002"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "8b54e794-c6f0-462e-9faa-c1001a673ac3",
"assignerShortName": "Liferay",
"cveId": "CVE-2024-38002",
"datePublished": "2024-10-22T15:12:42.223Z",
"dateReserved": "2024-06-11T15:40:10.985Z",
"dateUpdated": "2024-10-22T15:22:55.078Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2022-28980
Vulnerability from cvelistv5
Published
2022-09-22 00:13
Modified
2024-08-03 06:10
Severity ?
EPSS score ?
Summary
Multiple cross-site scripting (XSS) vulnerabilities in Liferay Portal v7.4.3.4 and Liferay DXP v7.4 GA allows attackers to execute arbitrary web scripts or HTML via parameters with the filter_ prefix.
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T06:10:57.547Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://liferay.com"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-28980-reflected-xss-with-filter_%2A-parameters-in-applied-fragment-filters"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in Liferay Portal v7.4.3.4 and Liferay DXP v7.4 GA allows attackers to execute arbitrary web scripts or HTML via parameters with the filter_ prefix."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-09-22T00:13:41",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "http://liferay.com"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-28980-reflected-xss-with-filter_%2A-parameters-in-applied-fragment-filters"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2022-28980",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in Liferay Portal v7.4.3.4 and Liferay DXP v7.4 GA allows attackers to execute arbitrary web scripts or HTML via parameters with the filter_ prefix."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://liferay.com",
"refsource": "MISC",
"url": "http://liferay.com"
},
{
"name": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-28980-reflected-xss-with-filter_*-parameters-in-applied-fragment-filters",
"refsource": "MISC",
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-28980-reflected-xss-with-filter_*-parameters-in-applied-fragment-filters"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2022-28980",
"datePublished": "2022-09-22T00:13:41",
"dateReserved": "2022-04-11T00:00:00",
"dateUpdated": "2024-08-03T06:10:57.547Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2023-42628
Vulnerability from cvelistv5
Published
2023-10-17 11:52
Modified
2024-08-02 19:23
Severity ?
EPSS score ?
Summary
Stored cross-site scripting (XSS) vulnerability in the Wiki widget in Liferay Portal 7.1.0 through 7.4.3.87, and Liferay DXP 7.0 fix pack 83 through 102, 7.1 fix pack 28 and earlier, 7.2 fix pack 20 and earlier, 7.3 update 33 and earlier, and 7.4 before update 88 allows remote attackers to inject arbitrary web script or HTML into a parent wiki page via a crafted payload injected into a wiki page's ‘Content’ text field.
References
| ▼ | URL | Tags |
|---|---|---|
| https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-42628 | vendor-advisory | |
| https://www.pentagrid.ch/en/blog/stored-cross-site-scripting-vulnerabilities-in-liferay-portal/ | third-party-advisory, exploit |
Impacted products
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T19:23:40.284Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-42628"
},
{
"tags": [
"third-party-advisory",
"exploit",
"x_transferred"
],
"url": "https://www.pentagrid.ch/en/blog/stored-cross-site-scripting-vulnerabilities-in-liferay-portal/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "DXP",
"vendor": "Liferay",
"versions": [
{
"lessThanOrEqual": "7.0.10-*",
"status": "affected",
"version": "7.0.10-de-83",
"versionType": "maven"
},
{
"lessThanOrEqual": "7.1.10-*",
"status": "affected",
"version": "7.1.10",
"versionType": "maven"
},
{
"lessThanOrEqual": "7.2.10-*",
"status": "affected",
"version": "7.2.10",
"versionType": "maven"
},
{
"lessThanOrEqual": "7.3.10-*",
"status": "affected",
"version": "7.3.10",
"versionType": "maven"
},
{
"lessThanOrEqual": "7.4.13.u87",
"status": "affected",
"version": "7.4.13",
"versionType": "maven"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Portal",
"vendor": "Liferay",
"versions": [
{
"lessThanOrEqual": "7.4.3.87",
"status": "affected",
"version": "7.1.0",
"versionType": "maven"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"user": "00000000-0000-4000-9000-000000000000",
"value": "Michael Oelke"
}
],
"datePublic": "2023-10-17T11:55:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Stored cross-site scripting (XSS) vulnerability in the Wiki widget in Liferay Portal 7.1.0 through 7.4.3.87, and Liferay DXP 7.0 fix pack 83 through 102, 7.1 fix pack 28 and earlier, 7.2 fix pack 20 and earlier, 7.3 update 33 and earlier, and 7.4 before update 88 allows remote attackers to inject arbitrary web script or HTML into a parent wiki page via a crafted payload injected into a wiki page\u0027s \u2018Content\u2019 text field."
}
],
"value": "Stored cross-site scripting (XSS) vulnerability in the Wiki widget in Liferay Portal 7.1.0 through 7.4.3.87, and Liferay DXP 7.0 fix pack 83 through 102, 7.1 fix pack 28 and earlier, 7.2 fix pack 20 and earlier, 7.3 update 33 and earlier, and 7.4 before update 88 allows remote attackers to inject arbitrary web script or HTML into a parent wiki page via a crafted payload injected into a wiki page\u0027s \u2018Content\u2019 text field."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-11-10T02:32:30.141Z",
"orgId": "8b54e794-c6f0-462e-9faa-c1001a673ac3",
"shortName": "Liferay"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-42628"
},
{
"tags": [
"third-party-advisory",
"exploit"
],
"url": "https://www.pentagrid.ch/en/blog/stored-cross-site-scripting-vulnerabilities-in-liferay-portal/"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "8b54e794-c6f0-462e-9faa-c1001a673ac3",
"assignerShortName": "Liferay",
"cveId": "CVE-2023-42628",
"datePublished": "2023-10-17T11:52:45.867Z",
"dateReserved": "2023-09-12T05:35:42.826Z",
"dateUpdated": "2024-08-02T19:23:40.284Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2022-42121
Vulnerability from cvelistv5
Published
2022-11-15 00:00
Modified
2024-08-03 13:03
Severity ?
EPSS score ?
Summary
A SQL injection vulnerability in the Layout module in Liferay Portal 7.1.3 through 7.4.3.4, and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 17, 7.3 before service pack 3, and 7.4 GA allows remote authenticated attackers to execute arbitrary SQL commands via a crafted payload injected into a page template's 'Name' field.
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T13:03:45.532Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "http://liferay.com"
},
{
"tags": [
"x_transferred"
],
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42121"
},
{
"tags": [
"x_transferred"
],
"url": "https://issues.liferay.com/browse/LPE-17414"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A SQL injection vulnerability in the Layout module in Liferay Portal 7.1.3 through 7.4.3.4, and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 17, 7.3 before service pack 3, and 7.4 GA allows remote authenticated attackers to execute arbitrary SQL commands via a crafted payload injected into a page template\u0027s \u0027Name\u0027 field."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-11-15T00:00:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "http://liferay.com"
},
{
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42121"
},
{
"url": "https://issues.liferay.com/browse/LPE-17414"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2022-42121",
"datePublished": "2022-11-15T00:00:00",
"dateReserved": "2022-10-03T00:00:00",
"dateUpdated": "2024-08-03T13:03:45.532Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2022-28978
Vulnerability from cvelistv5
Published
2022-09-21 23:38
Modified
2024-08-03 06:10
Severity ?
EPSS score ?
Summary
Stored cross-site scripting (XSS) vulnerability in the Site module's user membership administration page in Liferay Portal 7.0.1 through 7.4.1, and Liferay DXP 7.0 before fix pack 102, 7.1 before fix pack 26, 7.2 before fix pack 15, and 7.3 before service pack 3 allows remote attackers to inject arbitrary web script or HTML via the a user's name.
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T06:10:58.317Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://liferay.com"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-28978-stored-xss-with-user-name-in-site-membership"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Stored cross-site scripting (XSS) vulnerability in the Site module\u0027s user membership administration page in Liferay Portal 7.0.1 through 7.4.1, and Liferay DXP 7.0 before fix pack 102, 7.1 before fix pack 26, 7.2 before fix pack 15, and 7.3 before service pack 3 allows remote attackers to inject arbitrary web script or HTML via the a user\u0027s name."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-09-21T23:38:59",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "http://liferay.com"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-28978-stored-xss-with-user-name-in-site-membership"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2022-28978",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Stored cross-site scripting (XSS) vulnerability in the Site module\u0027s user membership administration page in Liferay Portal 7.0.1 through 7.4.1, and Liferay DXP 7.0 before fix pack 102, 7.1 before fix pack 26, 7.2 before fix pack 15, and 7.3 before service pack 3 allows remote attackers to inject arbitrary web script or HTML via the a user\u0027s name."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://liferay.com",
"refsource": "MISC",
"url": "http://liferay.com"
},
{
"name": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-28978-stored-xss-with-user-name-in-site-membership",
"refsource": "MISC",
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-28978-stored-xss-with-user-name-in-site-membership"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2022-28978",
"datePublished": "2022-09-21T23:38:59",
"dateReserved": "2022-04-11T00:00:00",
"dateUpdated": "2024-08-03T06:10:58.317Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2023-44308
Vulnerability from cvelistv5
Published
2024-02-20 06:29
Modified
2024-08-28 16:29
Severity ?
EPSS score ?
Summary
Open redirect vulnerability in adaptive media administration page in Liferay DXP 2023.Q3 before patch 6, and 7.4 GA through update 92 allows remote attackers to redirect users to arbitrary external URLs via the _com_liferay_adaptive_media_web_portlet_AMPortlet_redirect parameter.
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T19:59:52.152Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-44308"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"cpes": [
"cpe:2.3:a:liferay:digital_experience_platform:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "digital_experience_platform",
"vendor": "liferay",
"versions": [
{
"lessThanOrEqual": "7.4.13.u92",
"status": "affected",
"version": "7.4.13",
"versionType": "maven"
},
{
"lessThanOrEqual": "2023.q3.5",
"status": "affected",
"version": "2023.q3.1",
"versionType": "maven"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-44308",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-02-20T17:01:28.479397Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-08-28T16:29:31.044Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "DXP",
"vendor": "Liferay",
"versions": [
{
"lessThanOrEqual": "2023.q3.5",
"status": "affected",
"version": "2023.q3.1",
"versionType": "maven"
},
{
"lessThanOrEqual": "7.4.13.u92",
"status": "affected",
"version": "7.4.13",
"versionType": "maven"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"user": "00000000-0000-4000-9000-000000000000",
"value": "Amin ACHOUR"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Open redirect vulnerability in adaptive media administration page in Liferay DXP 2023.Q3 before patch 6, and 7.4 GA through update 92 allows remote attackers to redirect users to arbitrary external URLs via the _com_liferay_adaptive_media_web_portlet_AMPortlet_redirect parameter."
}
],
"value": "Open redirect vulnerability in adaptive media administration page in Liferay DXP 2023.Q3 before patch 6, and 7.4 GA through update 92 allows remote attackers to redirect users to arbitrary external URLs via the _com_liferay_adaptive_media_web_portlet_AMPortlet_redirect parameter."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-601",
"description": "CWE-601 URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-02-20T06:29:07.856Z",
"orgId": "8b54e794-c6f0-462e-9faa-c1001a673ac3",
"shortName": "Liferay"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-44308"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "8b54e794-c6f0-462e-9faa-c1001a673ac3",
"assignerShortName": "Liferay",
"cveId": "CVE-2023-44308",
"datePublished": "2024-02-20T06:29:07.856Z",
"dateReserved": "2023-09-28T11:23:54.828Z",
"dateUpdated": "2024-08-28T16:29:31.044Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2022-39975
Vulnerability from cvelistv5
Published
2022-09-21 23:35
Modified
2024-08-03 12:07
Severity ?
EPSS score ?
Summary
The Layout module in Liferay Portal v7.3.3 through v7.4.3.34, and Liferay DXP 7.3 before update 10, and 7.4 before update 35 does not check user permission before showing the preview of a "Content Page" type page, allowing attackers to view unpublished "Content Page" pages via URL manipulation.
References
| ▼ | URL | Tags |
|---|---|---|
| http://liferay.com | x_refsource_MISC | |
| https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-39975 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T12:07:42.971Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://liferay.com"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-39975"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The Layout module in Liferay Portal v7.3.3 through v7.4.3.34, and Liferay DXP 7.3 before update 10, and 7.4 before update 35 does not check user permission before showing the preview of a \"Content Page\" type page, allowing attackers to view unpublished \"Content Page\" pages via URL manipulation."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-09-21T23:35:57",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "http://liferay.com"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-39975"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2022-39975",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The Layout module in Liferay Portal v7.3.3 through v7.4.3.34, and Liferay DXP 7.3 before update 10, and 7.4 before update 35 does not check user permission before showing the preview of a \"Content Page\" type page, allowing attackers to view unpublished \"Content Page\" pages via URL manipulation."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://liferay.com",
"refsource": "MISC",
"url": "http://liferay.com"
},
{
"name": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-39975",
"refsource": "MISC",
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-39975"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2022-39975",
"datePublished": "2022-09-21T23:35:57",
"dateReserved": "2022-09-06T00:00:00",
"dateUpdated": "2024-08-03T12:07:42.971Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2024-25145
Vulnerability from cvelistv5
Published
2024-02-07 14:57
Modified
2024-08-22 19:00
Severity ?
EPSS score ?
Summary
Stored cross-site scripting (XSS) vulnerability in the Portal Search module's Search Result app in Liferay Portal 7.2.0 through 7.4.3.11, and older unsupported versions, and Liferay DXP 7.4 before update 8, 7.3 before update 4, 7.2 before fix pack 17, and older unsupported versions allows remote authenticated users to inject arbitrary web script or HTML into the Search Result app's search result if highlighting is disabled by adding any searchable content (e.g., blog, message board message, web content article) to the application.
References
Impacted products
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-01T23:36:21.657Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25145"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"cpes": [
"cpe:2.3:a:liferay:portal:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "portal",
"vendor": "liferay",
"versions": [
{
"lessThanOrEqual": "7.4.3.11",
"status": "affected",
"version": "7.2.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:liferay:dxp:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "dxp",
"vendor": "liferay",
"versions": [
{
"lessThanOrEqual": "7.4.13.u7",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThanOrEqual": "7.3.10-dxp-3",
"status": "affected",
"version": "7.3.10",
"versionType": "custom"
},
{
"lessThanOrEqual": "7.2.10-dxp-16",
"status": "affected",
"version": "7.2.10",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-25145",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-02-08T17:02:17.600468Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-08-22T19:00:34.686Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Portal",
"vendor": "Liferay",
"versions": [
{
"lessThanOrEqual": "7.4.3.11",
"status": "affected",
"version": "7.2.0",
"versionType": "maven"
}
]
},
{
"defaultStatus": "unaffected",
"product": "DXP",
"vendor": "Liferay",
"versions": [
{
"lessThanOrEqual": "7.4.13.u7",
"status": "affected",
"version": "7.4.13",
"versionType": "maven"
},
{
"lessThanOrEqual": "7.3.10-dxp-3",
"status": "affected",
"version": "7.3.10",
"versionType": "maven"
},
{
"lessThanOrEqual": "7.2.10-dxp-16",
"status": "affected",
"version": "7.2.10",
"versionType": "maven"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Stored cross-site scripting (XSS) vulnerability in the Portal Search module\u0027s Search Result app in Liferay Portal 7.2.0 through 7.4.3.11, and older unsupported versions, and Liferay DXP 7.4 before update 8, 7.3 before update 4, 7.2 before fix pack 17, and older unsupported versions allows remote authenticated users to inject arbitrary web script or HTML into the Search Result app\u0027s search result if highlighting is disabled by adding any searchable content (e.g., blog, message board message, web content article) to the application."
}
],
"value": "Stored cross-site scripting (XSS) vulnerability in the Portal Search module\u0027s Search Result app in Liferay Portal 7.2.0 through 7.4.3.11, and older unsupported versions, and Liferay DXP 7.4 before update 8, 7.3 before update 4, 7.2 before fix pack 17, and older unsupported versions allows remote authenticated users to inject arbitrary web script or HTML into the Search Result app\u0027s search result if highlighting is disabled by adding any searchable content (e.g., blog, message board message, web content article) to the application."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.6,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-02-07T14:57:33.054Z",
"orgId": "8b54e794-c6f0-462e-9faa-c1001a673ac3",
"shortName": "Liferay"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25145"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "8b54e794-c6f0-462e-9faa-c1001a673ac3",
"assignerShortName": "Liferay",
"cveId": "CVE-2024-25145",
"datePublished": "2024-02-07T14:57:33.054Z",
"dateReserved": "2024-02-06T10:32:42.566Z",
"dateUpdated": "2024-08-22T19:00:34.686Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2024-25143
Vulnerability from cvelistv5
Published
2024-02-07 14:45
Modified
2024-10-02 15:29
Severity ?
EPSS score ?
Summary
The Document and Media widget In Liferay Portal 7.2.0 through 7.3.6, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 13, and older unsupported versions, does not limit resource consumption when generating a preview image, which allows remote authenticated users to cause a denial of service (memory consumption) via crafted PNG images.
References
Impacted products
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-01T23:36:21.826Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25143"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-25143",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-08-19T20:07:01.114816Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-08-19T20:07:09.484Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "DXP",
"vendor": "Liferay",
"versions": [
{
"lessThanOrEqual": "7.3.10-dxp-2",
"status": "affected",
"version": "7.3.10",
"versionType": "maven"
},
{
"lessThanOrEqual": "7.2.10-dxp-12",
"status": "affected",
"version": "7.2.10",
"versionType": "maven"
}
]
},
{
"defaultStatus": "unknown",
"product": "Portal",
"vendor": "Liferay",
"versions": [
{
"lessThanOrEqual": "7.3.6",
"status": "affected",
"version": "7.2.0",
"versionType": "maven"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The Document and Media widget In Liferay Portal 7.2.0 through 7.3.6, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 13, and older unsupported versions, does not limit resource consumption when generating a preview image, which allows remote authenticated users to cause a denial of service (memory consumption) via crafted PNG images."
}
],
"value": "The Document and Media widget In Liferay Portal 7.2.0 through 7.3.6, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 13, and older unsupported versions, does not limit resource consumption when generating a preview image, which allows remote authenticated users to cause a denial of service (memory consumption) via crafted PNG images."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "CWE-770 Allocation of Resources Without Limits or Throttling",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-10-02T15:29:27.818Z",
"orgId": "8b54e794-c6f0-462e-9faa-c1001a673ac3",
"shortName": "Liferay"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25143"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "8b54e794-c6f0-462e-9faa-c1001a673ac3",
"assignerShortName": "Liferay",
"cveId": "CVE-2024-25143",
"datePublished": "2024-02-07T14:45:04.168Z",
"dateReserved": "2024-02-06T10:32:42.566Z",
"dateUpdated": "2024-10-02T15:29:27.818Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2021-33324
Vulnerability from cvelistv5
Published
2021-08-03 18:24
Modified
2024-08-03 23:50
Severity ?
EPSS score ?
Summary
The Layout module in Liferay Portal 7.1.0 through 7.3.1, and Liferay DXP 7.1 before fix pack 20, and 7.2 before fix pack 5, does not properly check permission of pages, which allows remote authenticated users without view permission of a page to view the page via a site's page administration.
References
| ▼ | URL | Tags |
|---|---|---|
| https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120747063 | x_refsource_CONFIRM | |
| https://issues.liferay.com/browse/LPE-17001 | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T23:50:42.915Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120747063"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://issues.liferay.com/browse/LPE-17001"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The Layout module in Liferay Portal 7.1.0 through 7.3.1, and Liferay DXP 7.1 before fix pack 20, and 7.2 before fix pack 5, does not properly check permission of pages, which allows remote authenticated users without view permission of a page to view the page via a site\u0027s page administration."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-08-03T18:24:05",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120747063"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://issues.liferay.com/browse/LPE-17001"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2021-33324",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The Layout module in Liferay Portal 7.1.0 through 7.3.1, and Liferay DXP 7.1 before fix pack 20, and 7.2 before fix pack 5, does not properly check permission of pages, which allows remote authenticated users without view permission of a page to view the page via a site\u0027s page administration."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120747063",
"refsource": "CONFIRM",
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120747063"
},
{
"name": "https://issues.liferay.com/browse/LPE-17001",
"refsource": "CONFIRM",
"url": "https://issues.liferay.com/browse/LPE-17001"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2021-33324",
"datePublished": "2021-08-03T18:24:05",
"dateReserved": "2021-05-20T00:00:00",
"dateUpdated": "2024-08-03T23:50:42.915Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2024-26266
Vulnerability from cvelistv5
Published
2024-02-21 02:32
Modified
2024-08-02 00:07
Severity ?
EPSS score ?
Summary
Multiple stored cross-site scripting (XSS) vulnerabilities in Liferay Portal 7.2.0 through 7.4.3.13, and older unsupported versions, and Liferay DXP 7.4 before update 10, 7.3 before update 4, 7.2 before fix pack 17, and older unsupported versions allow remote authenticated users to inject arbitrary web script or HTML via a crafted payload injected into the first/middle/last name text field of the user who creates an entry in the (1) Announcement widget, or (2) Alerts widget.
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-26266",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-02-22T16:43:41.174610Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-07-05T17:21:55.881Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T00:07:18.940Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-26266"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Portal",
"vendor": "Liferay",
"versions": [
{
"lessThanOrEqual": "7.4.3.13",
"status": "affected",
"version": "7.2.0",
"versionType": "maven"
}
]
},
{
"defaultStatus": "unknown",
"product": "DXP",
"vendor": "Liferay",
"versions": [
{
"lessThanOrEqual": "7.4.13.u9",
"status": "affected",
"version": "7.4.13",
"versionType": "maven"
},
{
"lessThanOrEqual": "7.3.10-dxp-3",
"status": "affected",
"version": "7.3.10",
"versionType": "maven"
},
{
"lessThanOrEqual": "7.2.10-dxp-16",
"status": "affected",
"version": "7.2.10",
"versionType": "maven"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Multiple stored cross-site scripting (XSS) vulnerabilities in Liferay Portal 7.2.0 through 7.4.3.13, and older unsupported versions, and Liferay DXP 7.4 before update 10, 7.3 before update 4, 7.2 before fix pack 17, and older unsupported versions allow remote authenticated users to inject arbitrary web script or HTML via a crafted payload injected into the first/middle/last name text field of the user who creates an entry in the (1) Announcement widget, or (2) Alerts widget."
}
],
"value": "Multiple stored cross-site scripting (XSS) vulnerabilities in Liferay Portal 7.2.0 through 7.4.3.13, and older unsupported versions, and Liferay DXP 7.4 before update 10, 7.3 before update 4, 7.2 before fix pack 17, and older unsupported versions allow remote authenticated users to inject arbitrary web script or HTML via a crafted payload injected into the first/middle/last name text field of the user who creates an entry in the (1) Announcement widget, or (2) Alerts widget."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-02-21T02:32:25.050Z",
"orgId": "8b54e794-c6f0-462e-9faa-c1001a673ac3",
"shortName": "Liferay"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-26266"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "8b54e794-c6f0-462e-9faa-c1001a673ac3",
"assignerShortName": "Liferay",
"cveId": "CVE-2024-26266",
"datePublished": "2024-02-21T02:32:25.050Z",
"dateReserved": "2024-02-15T07:44:36.776Z",
"dateUpdated": "2024-08-02T00:07:18.940Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2022-42117
Vulnerability from cvelistv5
Published
2022-10-18 00:00
Modified
2024-08-03 13:03
Severity ?
EPSS score ?
Summary
A Cross-site scripting (XSS) vulnerability in the Frontend Taglib module in Liferay Portal 7.3.2 through 7.4.3.16, and Liferay DXP 7.3 before update 6, and 7.4 before update 17 allows remote attackers to inject arbitrary web script or HTML.
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T13:03:45.793Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "http://liferay.com"
},
{
"tags": [
"x_transferred"
],
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42117"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A Cross-site scripting (XSS) vulnerability in the Frontend Taglib module in Liferay Portal 7.3.2 through 7.4.3.16, and Liferay DXP 7.3 before update 6, and 7.4 before update 17 allows remote attackers to inject arbitrary web script or HTML."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-10-18T00:00:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "http://liferay.com"
},
{
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42117"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2022-42117",
"datePublished": "2022-10-18T00:00:00",
"dateReserved": "2022-10-03T00:00:00",
"dateUpdated": "2024-08-03T13:03:45.793Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2021-29044
Vulnerability from cvelistv5
Published
2021-05-17 10:55
Modified
2024-08-03 21:55
Severity ?
EPSS score ?
Summary
Cross-site scripting (XSS) vulnerability in the Site module's membership request administration pages in Liferay Portal 7.0.0 through 7.3.5, and Liferay DXP 7.0 before fix pack 97, 7.1 before fix pack 21, 7.2 before fix pack 10 and 7.3 before fix pack 1 allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_site_my_sites_web_portlet_MySitesPortlet_comments parameter.
References
| ▼ | URL | Tags |
|---|---|---|
| http://liferay.com | x_refsource_MISC | |
| https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120743548 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T21:55:12.632Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://liferay.com"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120743548"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in the Site module\u0027s membership request administration pages in Liferay Portal 7.0.0 through 7.3.5, and Liferay DXP 7.0 before fix pack 97, 7.1 before fix pack 21, 7.2 before fix pack 10 and 7.3 before fix pack 1 allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_site_my_sites_web_portlet_MySitesPortlet_comments parameter."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-05-17T10:55:02",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "http://liferay.com"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120743548"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2021-29044",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in the Site module\u0027s membership request administration pages in Liferay Portal 7.0.0 through 7.3.5, and Liferay DXP 7.0 before fix pack 97, 7.1 before fix pack 21, 7.2 before fix pack 10 and 7.3 before fix pack 1 allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_site_my_sites_web_portlet_MySitesPortlet_comments parameter."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://liferay.com",
"refsource": "MISC",
"url": "http://liferay.com"
},
{
"name": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120743548",
"refsource": "MISC",
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120743548"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2021-29044",
"datePublished": "2021-05-17T10:55:02",
"dateReserved": "2021-03-22T00:00:00",
"dateUpdated": "2024-08-03T21:55:12.632Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2023-37940
Vulnerability from cvelistv5
Published
2024-12-17 21:30
Modified
2024-12-17 21:41
Severity ?
EPSS score ?
Summary
Cross-site scripting (XSS) vulnerability in the edit Service Access Policy page in Liferay Portal 7.0.0 through 7.4.3.87, and Liferay DXP 7.4 GA through update 87, 7.3 GA through update 29, and older unsupported versions allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a service access policy's `Service Class` text field.
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-37940",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-12-17T21:41:20.332148Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-12-17T21:41:38.543Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Portal",
"vendor": "Liferay",
"versions": [
{
"lessThanOrEqual": "7.4.3.87",
"status": "affected",
"version": "7.0.0",
"versionType": "maven"
}
]
},
{
"defaultStatus": "unaffected",
"product": "DXP",
"vendor": "Liferay",
"versions": [
{
"lessThanOrEqual": "de-102",
"status": "affected",
"version": "7.0.10",
"versionType": "maven"
},
{
"lessThanOrEqual": "dxp-28",
"status": "affected",
"version": "7.1.10",
"versionType": "maven"
},
{
"lessThanOrEqual": "dxp-20",
"status": "affected",
"version": "7.2.10",
"versionType": "maven"
},
{
"lessThanOrEqual": "7.3.10-u29",
"status": "affected",
"version": "7.3.10",
"versionType": "maven"
},
{
"lessThanOrEqual": "7.4.13-u87",
"status": "affected",
"version": "7.4.13",
"versionType": "maven"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "milCERT AT"
},
{
"lang": "en",
"type": "reporter",
"value": "Abderrahmane BOUNHIDJA"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Cross-site scripting (XSS) vulnerability in the edit Service Access Policy page in Liferay Portal 7.0.0 through 7.4.3.87, and Liferay DXP 7.4 GA through update 87, 7.3 GA through update 29, and older unsupported versions allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a service access policy\u0027s `Service Class` text field."
}
],
"value": "Cross-site scripting (XSS) vulnerability in the edit Service Access Policy page in Liferay Portal 7.0.0 through 7.4.3.87, and Liferay DXP 7.4 GA through update 87, 7.3 GA through update 29, and older unsupported versions allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a service access policy\u0027s `Service Class` text field."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or \u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-12-17T21:30:39.730Z",
"orgId": "8b54e794-c6f0-462e-9faa-c1001a673ac3",
"shortName": "Liferay"
},
"references": [
{
"url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2023-37940"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "8b54e794-c6f0-462e-9faa-c1001a673ac3",
"assignerShortName": "Liferay",
"cveId": "CVE-2023-37940",
"datePublished": "2024-12-17T21:30:39.730Z",
"dateReserved": "2023-07-11T09:17:17.552Z",
"dateUpdated": "2024-12-17T21:41:38.543Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2021-29049
Vulnerability from cvelistv5
Published
2021-06-09 18:46
Modified
2024-08-03 21:55
Severity ?
EPSS score ?
Summary
Cross-site scripting (XSS) vulnerability in the Portal Workflow module's edit process page in Liferay DXP 7.0 before fix pack 99, 7.1 before fix pack 23, 7.2 before fix pack 12 and 7.3 before fix pack 1, allows remote attackers to inject arbitrary web script or HTML via the currentURL parameter.
References
| ▼ | URL | Tags |
|---|---|---|
| http://liferay.com | x_refsource_MISC | |
| https://issues.liferay.com/browse/LPE-17211 | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T21:55:12.636Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://liferay.com"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://issues.liferay.com/browse/LPE-17211"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in the Portal Workflow module\u0027s edit process page in Liferay DXP 7.0 before fix pack 99, 7.1 before fix pack 23, 7.2 before fix pack 12 and 7.3 before fix pack 1, allows remote attackers to inject arbitrary web script or HTML via the currentURL parameter."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-06-09T18:46:16",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "http://liferay.com"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://issues.liferay.com/browse/LPE-17211"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2021-29049",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in the Portal Workflow module\u0027s edit process page in Liferay DXP 7.0 before fix pack 99, 7.1 before fix pack 23, 7.2 before fix pack 12 and 7.3 before fix pack 1, allows remote attackers to inject arbitrary web script or HTML via the currentURL parameter."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://liferay.com",
"refsource": "MISC",
"url": "http://liferay.com"
},
{
"name": "https://issues.liferay.com/browse/LPE-17211",
"refsource": "CONFIRM",
"url": "https://issues.liferay.com/browse/LPE-17211"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2021-29049",
"datePublished": "2021-06-09T18:46:16",
"dateReserved": "2021-03-22T00:00:00",
"dateUpdated": "2024-08-03T21:55:12.636Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2021-33335
Vulnerability from cvelistv5
Published
2021-08-03 21:03
Modified
2024-08-03 23:50
Severity ?
EPSS score ?
Summary
Privilege escalation vulnerability in Liferay Portal 7.0.3 through 7.3.4, and Liferay DXP 7.1 before fix pack 20, and 7.2 before fix pack 9 allows remote authenticated users with permission to update/edit users to take over a company administrator user account by editing the company administrator user.
References
| ▼ | URL | Tags |
|---|---|---|
| https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120747906 | x_refsource_CONFIRM | |
| https://issues.liferay.com/browse/LPE-17103 | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T23:50:42.962Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120747906"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://issues.liferay.com/browse/LPE-17103"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Privilege escalation vulnerability in Liferay Portal 7.0.3 through 7.3.4, and Liferay DXP 7.1 before fix pack 20, and 7.2 before fix pack 9 allows remote authenticated users with permission to update/edit users to take over a company administrator user account by editing the company administrator user."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-08-03T21:03:38",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120747906"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://issues.liferay.com/browse/LPE-17103"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2021-33335",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Privilege escalation vulnerability in Liferay Portal 7.0.3 through 7.3.4, and Liferay DXP 7.1 before fix pack 20, and 7.2 before fix pack 9 allows remote authenticated users with permission to update/edit users to take over a company administrator user account by editing the company administrator user."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120747906",
"refsource": "CONFIRM",
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120747906"
},
{
"name": "https://issues.liferay.com/browse/LPE-17103",
"refsource": "CONFIRM",
"url": "https://issues.liferay.com/browse/LPE-17103"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2021-33335",
"datePublished": "2021-08-03T21:03:38",
"dateReserved": "2021-05-20T00:00:00",
"dateUpdated": "2024-08-03T23:50:42.962Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2022-42110
Vulnerability from cvelistv5
Published
2022-11-14 00:00
Modified
2024-08-03 13:03
Severity ?
EPSS score ?
Summary
A Cross-site scripting (XSS) vulnerability in the Announcements module in Liferay Portal 7.1.0 through 7.4.2, and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 17, and 7.3 before service pack 3 allows remote attackers to inject arbitrary web script or HTML.
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T13:03:45.457Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42110"
},
{
"tags": [
"x_transferred"
],
"url": "https://issues.liferay.com/browse/LPE-17403"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A Cross-site scripting (XSS) vulnerability in the Announcements module in Liferay Portal 7.1.0 through 7.4.2, and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 17, and 7.3 before service pack 3 allows remote attackers to inject arbitrary web script or HTML."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-11-14T00:00:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42110"
},
{
"url": "https://issues.liferay.com/browse/LPE-17403"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2022-42110",
"datePublished": "2022-11-14T00:00:00",
"dateReserved": "2022-10-03T00:00:00",
"dateUpdated": "2024-08-03T13:03:45.457Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2021-33323
Vulnerability from cvelistv5
Published
2021-08-03 18:19
Modified
2024-08-03 23:50
Severity ?
EPSS score ?
Summary
The Dynamic Data Mapping module in Liferay Portal 7.1.0 through 7.3.2, and Liferay DXP 7.1 before fix pack 19, and 7.2 before fix pack 7, autosaves form values for unauthenticated users, which allows remote attackers to view the autosaved values by viewing the form as an unauthenticated user.
References
| ▼ | URL | Tags |
|---|---|---|
| https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120747107 | x_refsource_CONFIRM | |
| https://issues.liferay.com/browse/LPE-17049 | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T23:50:41.443Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120747107"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://issues.liferay.com/browse/LPE-17049"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The Dynamic Data Mapping module in Liferay Portal 7.1.0 through 7.3.2, and Liferay DXP 7.1 before fix pack 19, and 7.2 before fix pack 7, autosaves form values for unauthenticated users, which allows remote attackers to view the autosaved values by viewing the form as an unauthenticated user."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-08-03T18:19:24",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120747107"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://issues.liferay.com/browse/LPE-17049"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2021-33323",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The Dynamic Data Mapping module in Liferay Portal 7.1.0 through 7.3.2, and Liferay DXP 7.1 before fix pack 19, and 7.2 before fix pack 7, autosaves form values for unauthenticated users, which allows remote attackers to view the autosaved values by viewing the form as an unauthenticated user."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120747107",
"refsource": "CONFIRM",
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120747107"
},
{
"name": "https://issues.liferay.com/browse/LPE-17049",
"refsource": "CONFIRM",
"url": "https://issues.liferay.com/browse/LPE-17049"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2021-33323",
"datePublished": "2021-08-03T18:19:24",
"dateReserved": "2021-05-20T00:00:00",
"dateUpdated": "2024-08-03T23:50:41.443Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2024-26271
Vulnerability from cvelistv5
Published
2024-10-22 14:06
Modified
2024-10-22 20:07
Severity ?
EPSS score ?
Summary
Cross-site request forgery (CSRF) vulnerability in the My Account widget in Liferay Portal 7.4.3.75 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.2, 2023.Q3.1 through 2023.Q3.5, 7.4 update 75 through update 92 and 7.3 update 32 through update 36 allows remote attackers to (1) change user passwords, (2) shut down the server, (3) execute arbitrary code in the scripting console, (4) and perform other administrative actions via the _com_liferay_my_account_web_portlet_MyAccountPortlet_backURL parameter.
References
Impacted products
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:liferay:portal:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "portal",
"vendor": "liferay",
"versions": [
{
"lessThanOrEqual": "7.4.3.75",
"status": "affected",
"version": "7.4.3.111",
"versionType": "maven"
}
]
},
{
"cpes": [
"cpe:2.3:a:liferay:dxp:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "dxp",
"vendor": "liferay",
"versions": [
{
"lessThanOrEqual": "7.3.10-u35",
"status": "affected",
"version": "7.3.10-u32",
"versionType": "maven"
},
{
"lessThanOrEqual": "7.4.13-u92",
"status": "affected",
"version": "7.4.13-u75",
"versionType": "maven"
},
{
"lessThanOrEqual": "2023.Q3.5",
"status": "affected",
"version": "2023.Q3.1",
"versionType": "maven"
},
{
"lessThanOrEqual": "2023.Q4.2",
"status": "affected",
"version": "2023.Q4.0",
"versionType": "maven"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-26271",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-10-22T19:56:06.754670Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-10-22T20:07:01.935Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Portal",
"vendor": "Liferay",
"versions": [
{
"lessThanOrEqual": "7.4.3.111",
"status": "affected",
"version": "7.4.3.75",
"versionType": "maven"
}
]
},
{
"defaultStatus": "unaffected",
"product": "DXP",
"vendor": "Liferay",
"versions": [
{
"lessThanOrEqual": "7.3.10-u35",
"status": "affected",
"version": "7.3.10-u32",
"versionType": "maven"
},
{
"lessThanOrEqual": "7.4.13-u92",
"status": "affected",
"version": "7.4.13-u75",
"versionType": "maven"
},
{
"lessThanOrEqual": "2023.Q3.5",
"status": "affected",
"version": "2023.Q3.1",
"versionType": "maven"
},
{
"lessThanOrEqual": "2023.Q4.2",
"status": "affected",
"version": "2023.Q4.0",
"versionType": "maven"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Cross-site request forgery (CSRF) vulnerability in the My Account widget in Liferay Portal 7.4.3.75 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.2, 2023.Q3.1 through 2023.Q3.5, 7.4 update 75 through update 92 and 7.3 update 32 through update 36 allows remote attackers to (1) change user passwords, (2) shut down the server, (3) execute arbitrary code in the scripting console, (4) and perform other administrative actions via the _com_liferay_my_account_web_portlet_MyAccountPortlet_backURL parameter."
}
],
"value": "Cross-site request forgery (CSRF) vulnerability in the My Account widget in Liferay Portal 7.4.3.75 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.2, 2023.Q3.1 through 2023.Q3.5, 7.4 update 75 through update 92 and 7.3 update 32 through update 36 allows remote attackers to (1) change user passwords, (2) shut down the server, (3) execute arbitrary code in the scripting console, (4) and perform other administrative actions via the _com_liferay_my_account_web_portlet_MyAccountPortlet_backURL parameter."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-352",
"description": "CWE-352 Cross-Site Request Forgery (CSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-10-22T14:06:16.533Z",
"orgId": "8b54e794-c6f0-462e-9faa-c1001a673ac3",
"shortName": "Liferay"
},
"references": [
{
"url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2024-26271"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "8b54e794-c6f0-462e-9faa-c1001a673ac3",
"assignerShortName": "Liferay",
"cveId": "CVE-2024-26271",
"datePublished": "2024-10-22T14:06:16.533Z",
"dateReserved": "2024-02-15T07:44:36.776Z",
"dateUpdated": "2024-10-22T20:07:01.935Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2024-25144
Vulnerability from cvelistv5
Published
2024-02-08 03:25
Modified
2024-10-02 15:31
Severity ?
EPSS score ?
Summary
The IFrame widget in Liferay Portal 7.2.0 through 7.4.3.26, and older unsupported versions, and Liferay DXP 7.4 before update 27, 7.3 before update 6, 7.2 before fix pack 19, and older unsupported versions does not check the URL of the IFrame, which allows remote authenticated users to cause a denial-of-service (DoS) via a self referencing IFrame.
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-25144",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-02-08T20:11:12.629935Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-07-05T17:20:46.824Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-01T23:36:21.643Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25144"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Portal",
"vendor": "Liferay",
"versions": [
{
"lessThanOrEqual": "7.4.3.26",
"status": "affected",
"version": "7.2.0",
"versionType": "maven"
}
]
},
{
"defaultStatus": "unknown",
"product": "DXP",
"vendor": "Liferay",
"versions": [
{
"lessThanOrEqual": "7.4.13.u26",
"status": "affected",
"version": "7.4.13",
"versionType": "maven"
},
{
"lessThanOrEqual": "7.3.10.u5",
"status": "affected",
"version": "7.3.10",
"versionType": "maven"
},
{
"lessThanOrEqual": "7.2.10-dxp-18",
"status": "affected",
"version": "7.2.10",
"versionType": "maven"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The IFrame widget in Liferay Portal 7.2.0 through 7.4.3.26, and older unsupported versions, and Liferay DXP 7.4 before update 27, 7.3 before update 6, 7.2 before fix pack 19, and older unsupported versions does not check the URL of the IFrame, which allows remote authenticated users to cause a denial-of-service (DoS) via a self referencing IFrame."
}
],
"value": "The IFrame widget in Liferay Portal 7.2.0 through 7.4.3.26, and older unsupported versions, and Liferay DXP 7.4 before update 27, 7.3 before update 6, 7.2 before fix pack 19, and older unsupported versions does not check the URL of the IFrame, which allows remote authenticated users to cause a denial-of-service (DoS) via a self referencing IFrame."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 4.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:N/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-835",
"description": "CWE-835 Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-10-02T15:31:02.494Z",
"orgId": "8b54e794-c6f0-462e-9faa-c1001a673ac3",
"shortName": "Liferay"
},
"references": [
{
"url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25144"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "8b54e794-c6f0-462e-9faa-c1001a673ac3",
"assignerShortName": "Liferay",
"cveId": "CVE-2024-25144",
"datePublished": "2024-02-08T03:25:31.037Z",
"dateReserved": "2024-02-06T10:32:42.566Z",
"dateUpdated": "2024-10-02T15:31:02.494Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2024-25603
Vulnerability from cvelistv5
Published
2024-02-21 02:09
Modified
2024-08-20 19:57
Severity ?
EPSS score ?
Summary
Stored cross-site scripting (XSS) vulnerability in the Dynamic Data Mapping module's DDMForm in Liferay Portal 7.2.0 through 7.4.3.4, and older unsupported versions, and Liferay DXP 7.4.13, 7.3 before update 4, 7.2 before fix pack 17, and older unsupported versions allows remote authenticated users to inject arbitrary web script or HTML via the instanceId parameter.
References
Impacted products
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-01T23:44:09.668Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25603"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"cpes": [
"cpe:2.3:a:liferay:portal:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "portal",
"vendor": "liferay",
"versions": [
{
"lessThanOrEqual": "7.4.3.4",
"status": "affected",
"version": "7.2.0",
"versionType": "maven"
}
]
},
{
"cpes": [
"cpe:2.3:a:liferay:digital_experience_platform:7.4.13:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "digital_experience_platform",
"vendor": "liferay",
"versions": [
{
"status": "affected",
"version": "7.4.13"
}
]
},
{
"cpes": [
"cpe:2.3:a:liferay:digital_experience_platform:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "digital_experience_platform",
"vendor": "liferay",
"versions": [
{
"lessThanOrEqual": "7.3.10-dxp-3",
"status": "affected",
"version": "7.3.10",
"versionType": "maven"
},
{
"lessThanOrEqual": "7.2.10-dxp-16",
"status": "affected",
"version": "7.2.10",
"versionType": "maven"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-25603",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-08-15T15:56:27.091382Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-08-20T19:57:19.139Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Portal",
"vendor": "Liferay",
"versions": [
{
"lessThanOrEqual": "7.4.3.4",
"status": "affected",
"version": "7.2.0",
"versionType": "maven"
}
]
},
{
"defaultStatus": "unknown",
"product": "DXP",
"vendor": "Liferay",
"versions": [
{
"status": "affected",
"version": "7.4.13"
},
{
"lessThanOrEqual": "7.3.10-dxp-3",
"status": "affected",
"version": "7.3.10",
"versionType": "maven"
},
{
"lessThanOrEqual": "7.2.10-dxp-16",
"status": "affected",
"version": "7.2.10",
"versionType": "maven"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Stored cross-site scripting (XSS) vulnerability in the Dynamic Data Mapping module\u0027s DDMForm in Liferay Portal 7.2.0 through 7.4.3.4, and older unsupported versions, and Liferay DXP 7.4.13, 7.3 before update 4, 7.2 before fix pack 17, and older unsupported versions allows remote authenticated users to inject arbitrary web script or HTML via the instanceId parameter."
}
],
"value": "Stored cross-site scripting (XSS) vulnerability in the Dynamic Data Mapping module\u0027s DDMForm in Liferay Portal 7.2.0 through 7.4.3.4, and older unsupported versions, and Liferay DXP 7.4.13, 7.3 before update 4, 7.2 before fix pack 17, and older unsupported versions allows remote authenticated users to inject arbitrary web script or HTML via the instanceId parameter."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-02-21T02:09:59.923Z",
"orgId": "8b54e794-c6f0-462e-9faa-c1001a673ac3",
"shortName": "Liferay"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25603"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "8b54e794-c6f0-462e-9faa-c1001a673ac3",
"assignerShortName": "Liferay",
"cveId": "CVE-2024-25603",
"datePublished": "2024-02-21T02:09:59.923Z",
"dateReserved": "2024-02-08T13:57:11.425Z",
"dateUpdated": "2024-08-20T19:57:19.139Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2023-33944
Vulnerability from cvelistv5
Published
2023-05-24 15:07
Modified
2024-10-22 15:52
Severity ?
EPSS score ?
Summary
Cross-site scripting (XSS) vulnerability in Layout module in Liferay Portal 7.3.4 through 7.4.3.68, and Liferay DXP 7.3 before update 24, and 7.4 before update 69 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a container type layout fragment's `URL` text field.
References
Impacted products
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T15:54:13.400Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-33944"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-33944",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-10-22T15:45:15.910473Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-10-22T15:52:07.008Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Portal",
"vendor": "Liferay",
"versions": [
{
"lessThanOrEqual": "7.4.3.68",
"status": "affected",
"version": "7.3.4",
"versionType": "maven"
}
]
},
{
"defaultStatus": "unaffected",
"product": "DXP",
"vendor": "Liferay",
"versions": [
{
"lessThanOrEqual": "7.3.10.u23",
"status": "affected",
"version": "7.3.10",
"versionType": "maven"
},
{
"lessThanOrEqual": "7.4.13.u68",
"status": "affected",
"version": "7.4.13",
"versionType": "maven"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Cross-site scripting (XSS) vulnerability in Layout module in Liferay Portal 7.3.4 through 7.4.3.68, and Liferay DXP 7.3 before update 24, and 7.4 before update 69 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a container type layout fragment\u0027s `URL` text field."
}
],
"value": "Cross-site scripting (XSS) vulnerability in Layout module in Liferay Portal 7.3.4 through 7.4.3.68, and Liferay DXP 7.3 before update 24, and 7.4 before update 69 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a container type layout fragment\u0027s `URL` text field."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-05-24T15:07:14.026Z",
"orgId": "8b54e794-c6f0-462e-9faa-c1001a673ac3",
"shortName": "Liferay"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-33944"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "8b54e794-c6f0-462e-9faa-c1001a673ac3",
"assignerShortName": "Liferay",
"cveId": "CVE-2023-33944",
"datePublished": "2023-05-24T15:07:14.026Z",
"dateReserved": "2023-05-24T02:36:00.164Z",
"dateUpdated": "2024-10-22T15:52:07.008Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2023-35029
Vulnerability from cvelistv5
Published
2023-06-15 03:59
Modified
2024-10-22 15:41
Severity ?
EPSS score ?
Summary
Open redirect vulnerability in the Layout module's SEO configuration in Liferay Portal 7.4.3.70 through 7.4.3.76, and Liferay DXP 7.4 update 70 through 76 allows remote attackers to redirect users to arbitrary external URLs via the `_com_liferay_layout_admin_web_portlet_GroupPagesPortlet_backURL` parameter.
References
Impacted products
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T16:17:04.188Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-35029"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-35029",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-10-22T15:41:37.684040Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-10-22T15:41:49.018Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Portal",
"vendor": "Liferay",
"versions": [
{
"lessThanOrEqual": "7.4.3.76",
"status": "affected",
"version": "7.4.3.70",
"versionType": "maven"
}
]
},
{
"defaultStatus": "unaffected",
"product": "DXP",
"vendor": "Liferay",
"versions": [
{
"lessThanOrEqual": "7.4.13.u76",
"status": "affected",
"version": "7.4.13.u70",
"versionType": "maven"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"user": "00000000-0000-4000-9000-000000000000",
"value": "Henrik Bayer (NDIx)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Open redirect vulnerability in the Layout module\u0027s SEO configuration in Liferay Portal 7.4.3.70 through 7.4.3.76, and Liferay DXP 7.4 update 70 through 76 allows remote attackers to redirect users to arbitrary external URLs via the `_com_liferay_layout_admin_web_portlet_GroupPagesPortlet_backURL` parameter."
}
],
"value": "Open redirect vulnerability in the Layout module\u0027s SEO configuration in Liferay Portal 7.4.3.70 through 7.4.3.76, and Liferay DXP 7.4 update 70 through 76 allows remote attackers to redirect users to arbitrary external URLs via the `_com_liferay_layout_admin_web_portlet_GroupPagesPortlet_backURL` parameter."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-601",
"description": "CWE-601 URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-06-15T03:59:44.155Z",
"orgId": "8b54e794-c6f0-462e-9faa-c1001a673ac3",
"shortName": "Liferay"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-35029"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "8b54e794-c6f0-462e-9faa-c1001a673ac3",
"assignerShortName": "Liferay",
"cveId": "CVE-2023-35029",
"datePublished": "2023-06-15T03:59:44.155Z",
"dateReserved": "2023-06-12T01:29:57.067Z",
"dateUpdated": "2024-10-22T15:41:49.018Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2022-28982
Vulnerability from cvelistv5
Published
2022-09-21 23:57
Modified
2024-08-03 06:10
Severity ?
EPSS score ?
Summary
A cross-site scripting (XSS) vulnerability in Liferay Portal v7.3.3 through v7.4.2 and Liferay DXP v7.3 before service pack 3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the name of a tag.
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T06:10:57.773Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://liferay.com"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-28982-reflected-xss-with-tag-name-in-%253Cliferay-asset-asset-tags-selector%253E"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A cross-site scripting (XSS) vulnerability in Liferay Portal v7.3.3 through v7.4.2 and Liferay DXP v7.3 before service pack 3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the name of a tag."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-09-21T23:57:41",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "http://liferay.com"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-28982-reflected-xss-with-tag-name-in-%253Cliferay-asset-asset-tags-selector%253E"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2022-28982",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A cross-site scripting (XSS) vulnerability in Liferay Portal v7.3.3 through v7.4.2 and Liferay DXP v7.3 before service pack 3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the name of a tag."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://liferay.com",
"refsource": "MISC",
"url": "http://liferay.com"
},
{
"name": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-28982-reflected-xss-with-tag-name-in-%253Cliferay-asset-asset-tags-selector%253E",
"refsource": "MISC",
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-28982-reflected-xss-with-tag-name-in-%253Cliferay-asset-asset-tags-selector%253E"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2022-28982",
"datePublished": "2022-09-21T23:57:41",
"dateReserved": "2022-04-11T00:00:00",
"dateUpdated": "2024-08-03T06:10:57.773Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2022-28977
Vulnerability from cvelistv5
Published
2022-09-22 00:02
Modified
2024-08-03 06:10
Severity ?
EPSS score ?
Summary
HtmlUtil.escapeRedirect in Liferay Portal 7.3.1 through 7.4.2, and Liferay DXP 7.0 fix pack 91 through 101, 7.1 fix pack 17 through 25, 7.2 fix pack 5 through 14, and 7.3 before service pack 3 can be circumvented by using multiple forward slashes, which allows remote attackers to redirect users to arbitrary external URLs via the (1) 'redirect` parameter (2) `FORWARD_URL` parameter, and (3) others parameters that rely on HtmlUtil.escapeRedirect.
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T06:10:58.669Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://liferay.com"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-28977-htmlutil.escaperedirect-circumvention-with-multiple-forward-slash"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "HtmlUtil.escapeRedirect in Liferay Portal 7.3.1 through 7.4.2, and Liferay DXP 7.0 fix pack 91 through 101, 7.1 fix pack 17 through 25, 7.2 fix pack 5 through 14, and 7.3 before service pack 3 can be circumvented by using multiple forward slashes, which allows remote attackers to redirect users to arbitrary external URLs via the (1) \u0027redirect` parameter (2) `FORWARD_URL` parameter, and (3) others parameters that rely on HtmlUtil.escapeRedirect."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-09-22T00:02:08",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "http://liferay.com"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-28977-htmlutil.escaperedirect-circumvention-with-multiple-forward-slash"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2022-28977",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "HtmlUtil.escapeRedirect in Liferay Portal 7.3.1 through 7.4.2, and Liferay DXP 7.0 fix pack 91 through 101, 7.1 fix pack 17 through 25, 7.2 fix pack 5 through 14, and 7.3 before service pack 3 can be circumvented by using multiple forward slashes, which allows remote attackers to redirect users to arbitrary external URLs via the (1) \u0027redirect` parameter (2) `FORWARD_URL` parameter, and (3) others parameters that rely on HtmlUtil.escapeRedirect."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://liferay.com",
"refsource": "MISC",
"url": "http://liferay.com"
},
{
"name": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-28977-htmlutil.escaperedirect-circumvention-with-multiple-forward-slash",
"refsource": "MISC",
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-28977-htmlutil.escaperedirect-circumvention-with-multiple-forward-slash"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2022-28977",
"datePublished": "2022-09-22T00:02:08",
"dateReserved": "2022-04-11T00:00:00",
"dateUpdated": "2024-08-03T06:10:58.669Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2022-42111
Vulnerability from cvelistv5
Published
2022-11-15 00:00
Modified
2024-08-03 13:03
Severity ?
EPSS score ?
Summary
A Cross-site scripting (XSS) vulnerability in the Sharing module's user notification in Liferay Portal 7.2.1 through 7.4.2, and Liferay DXP 7.2 before fix pack 19, and 7.3 before update 4 allows remote attackers to inject arbitrary web script or HTML by sharing an asset with a crafted payload.
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T13:03:44.112Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42111"
},
{
"tags": [
"x_transferred"
],
"url": "https://issues.liferay.com/browse/LPE-17379"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A Cross-site scripting (XSS) vulnerability in the Sharing module\u0027s user notification in Liferay Portal 7.2.1 through 7.4.2, and Liferay DXP 7.2 before fix pack 19, and 7.3 before update 4 allows remote attackers to inject arbitrary web script or HTML by sharing an asset with a crafted payload."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-11-15T00:00:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42111"
},
{
"url": "https://issues.liferay.com/browse/LPE-17379"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2022-42111",
"datePublished": "2022-11-15T00:00:00",
"dateReserved": "2022-10-03T00:00:00",
"dateUpdated": "2024-08-03T13:03:44.112Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2024-25608
Vulnerability from cvelistv5
Published
2024-02-20 09:26
Modified
2024-08-01 23:44
Severity ?
EPSS score ?
Summary
HtmlUtil.escapeRedirect in Liferay Portal 7.2.0 through 7.4.3.18, and older unsupported versions, and Liferay DXP 7.4 before update 19, 7.3 before update 4, 7.2 before fix pack 19, and older unsupported versions can be circumvented by using the 'REPLACEMENT CHARACTER' (U+FFFD), which allows remote attackers to redirect users to arbitrary external URLs via the (1) 'redirect` parameter (2) `FORWARD_URL` parameter, (3) `noSuchEntryRedirect` parameter, and (4) others parameters that rely on HtmlUtil.escapeRedirect.
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-25608",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-02-20T17:50:15.005965Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-07-05T17:21:47.059Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-01T23:44:09.704Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25608"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Portal",
"vendor": "Liferay",
"versions": [
{
"lessThanOrEqual": "7.4.3.18",
"status": "affected",
"version": "7.2.0",
"versionType": "maven"
}
]
},
{
"defaultStatus": "unknown",
"product": "DXP",
"vendor": "Liferay",
"versions": [
{
"lessThanOrEqual": "7.4.13.u18",
"status": "affected",
"version": "7.4.13",
"versionType": "maven"
},
{
"lessThanOrEqual": "7.3.10-dxp-3",
"status": "affected",
"version": "7.3.10",
"versionType": "maven"
},
{
"lessThanOrEqual": "7.2.10-dxp-18",
"status": "affected",
"version": "7.2.10",
"versionType": "maven"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "HtmlUtil.escapeRedirect in Liferay Portal 7.2.0 through 7.4.3.18, and older unsupported versions, and Liferay DXP 7.4 before update 19, 7.3 before update 4, 7.2 before fix pack 19, and older unsupported versions can be circumvented by using the \u0027REPLACEMENT CHARACTER\u0027 (U+FFFD), which allows remote attackers to redirect users to arbitrary external URLs via the (1) \u0027redirect` parameter (2) `FORWARD_URL` parameter, (3) `noSuchEntryRedirect` parameter, and (4) others parameters that rely on HtmlUtil.escapeRedirect."
}
],
"value": "HtmlUtil.escapeRedirect in Liferay Portal 7.2.0 through 7.4.3.18, and older unsupported versions, and Liferay DXP 7.4 before update 19, 7.3 before update 4, 7.2 before fix pack 19, and older unsupported versions can be circumvented by using the \u0027REPLACEMENT CHARACTER\u0027 (U+FFFD), which allows remote attackers to redirect users to arbitrary external URLs via the (1) \u0027redirect` parameter (2) `FORWARD_URL` parameter, (3) `noSuchEntryRedirect` parameter, and (4) others parameters that rely on HtmlUtil.escapeRedirect."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-601",
"description": "CWE-601 URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-02-20T09:26:10.743Z",
"orgId": "8b54e794-c6f0-462e-9faa-c1001a673ac3",
"shortName": "Liferay"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25608"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "8b54e794-c6f0-462e-9faa-c1001a673ac3",
"assignerShortName": "Liferay",
"cveId": "CVE-2024-25608",
"datePublished": "2024-02-20T09:26:10.743Z",
"dateReserved": "2024-02-08T13:57:11.426Z",
"dateUpdated": "2024-08-01T23:44:09.704Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2021-29051
Vulnerability from cvelistv5
Published
2021-05-17 11:01
Modified
2024-08-03 21:55
Severity ?
EPSS score ?
Summary
Cross-site scripting (XSS) vulnerability in the Asset module's Asset Publisher app in Liferay Portal 7.2.1 through 7.3.5, and Liferay DXP 7.1 before fix pack 21, 7.2 before fix pack 10 and 7.3 before fix pack 1 allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_XXXXXXXXXXXX_assetEntryId parameter.
References
| ▼ | URL | Tags |
|---|---|---|
| http://liferay.com | x_refsource_MISC | |
| https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120743580 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T21:55:12.676Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://liferay.com"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120743580"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in the Asset module\u0027s Asset Publisher app in Liferay Portal 7.2.1 through 7.3.5, and Liferay DXP 7.1 before fix pack 21, 7.2 before fix pack 10 and 7.3 before fix pack 1 allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_XXXXXXXXXXXX_assetEntryId parameter."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-05-17T11:01:49",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "http://liferay.com"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120743580"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2021-29051",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in the Asset module\u0027s Asset Publisher app in Liferay Portal 7.2.1 through 7.3.5, and Liferay DXP 7.1 before fix pack 21, 7.2 before fix pack 10 and 7.3 before fix pack 1 allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_XXXXXXXXXXXX_assetEntryId parameter."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://liferay.com",
"refsource": "MISC",
"url": "http://liferay.com"
},
{
"name": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120743580",
"refsource": "MISC",
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120743580"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2021-29051",
"datePublished": "2021-05-17T11:01:49",
"dateReserved": "2021-03-22T00:00:00",
"dateUpdated": "2024-08-03T21:55:12.676Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2024-25147
Vulnerability from cvelistv5
Published
2024-02-21 01:16
Modified
2024-08-01 23:36
Severity ?
EPSS score ?
Summary
Cross-site scripting (XSS) vulnerability in HtmlUtil.escapeJsLink in Liferay Portal 7.2.0 through 7.4.1, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 15, and older unsupported versions allows remote attackers to inject arbitrary web script or HTML via crafted javascript: style links.
References
Impacted products
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:liferay:portal:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "portal",
"vendor": "liferay",
"versions": [
{
"lessThanOrEqual": "7.4.1",
"status": "affected",
"version": "7.2.0",
"versionType": "maven"
}
]
},
{
"cpes": [
"cpe:2.3:a:liferay:dxp:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "dxp",
"vendor": "liferay",
"versions": [
{
"lessThanOrEqual": "7.3.10-dxp-2",
"status": "affected",
"version": "7.3.10",
"versionType": "maven"
},
{
"lessThanOrEqual": "7.2.10-dxp-14",
"status": "affected",
"version": "7.2.10",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-25147",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-02-21T16:15:43.147628Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-07-26T16:49:27.250Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-01T23:36:21.759Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25147"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Portal",
"vendor": "Liferay",
"versions": [
{
"lessThanOrEqual": "7.4.1",
"status": "affected",
"version": "7.2.0",
"versionType": "maven"
}
]
},
{
"defaultStatus": "unknown",
"product": "DXP",
"vendor": "Liferay",
"versions": [
{
"lessThanOrEqual": "7.3.10-dxp-2",
"status": "affected",
"version": "7.3.10",
"versionType": "maven"
},
{
"lessThanOrEqual": "7.2.10-dxp-14",
"status": "affected",
"version": "7.2.10",
"versionType": "maven"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Cross-site scripting (XSS) vulnerability in HtmlUtil.escapeJsLink in Liferay Portal 7.2.0 through 7.4.1, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 15, and older unsupported versions allows remote attackers to inject arbitrary web script or HTML via crafted javascript: style links."
}
],
"value": "Cross-site scripting (XSS) vulnerability in HtmlUtil.escapeJsLink in Liferay Portal 7.2.0 through 7.4.1, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 15, and older unsupported versions allows remote attackers to inject arbitrary web script or HTML via crafted javascript: style links."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.6,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-02-21T01:16:21.256Z",
"orgId": "8b54e794-c6f0-462e-9faa-c1001a673ac3",
"shortName": "Liferay"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25147"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "8b54e794-c6f0-462e-9faa-c1001a673ac3",
"assignerShortName": "Liferay",
"cveId": "CVE-2024-25147",
"datePublished": "2024-02-21T01:16:21.256Z",
"dateReserved": "2024-02-06T10:32:42.567Z",
"dateUpdated": "2024-08-01T23:36:21.759Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2024-25149
Vulnerability from cvelistv5
Published
2024-02-20 07:00
Modified
2024-08-01 23:36
Severity ?
EPSS score ?
Summary
Liferay Portal 7.2.0 through 7.4.1, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 15, and older unsupported versions does not properly restrict membership of a child site when the "Limit membership to members of the parent site" option is enabled, which allows remote authenticated users to add users who are not a member of the parent site to a child site. The added user may obtain permission to perform unauthorized actions in the child site.
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-25149",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-02-22T17:46:50.710330Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-04T17:35:34.318Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-01T23:36:21.703Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25149"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Portal",
"vendor": "Liferay",
"versions": [
{
"lessThanOrEqual": "7.4.1",
"status": "affected",
"version": "7.2.0",
"versionType": "maven"
}
]
},
{
"defaultStatus": "unknown",
"product": "DXP",
"vendor": "Liferay",
"versions": [
{
"lessThanOrEqual": "7.3.10-dxp-2",
"status": "affected",
"version": "7.3.10",
"versionType": "maven"
},
{
"lessThanOrEqual": "7.2.10-dxp-14",
"status": "affected",
"version": "7.2.10",
"versionType": "maven"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Liferay Portal 7.2.0 through 7.4.1, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 15, and older unsupported versions does not properly restrict membership of a child site when the \"Limit membership to members of the parent site\" option is enabled, which allows remote authenticated users to add users who are not a member of the parent site to a child site. The added user may obtain permission to perform unauthorized actions in the child site."
}
],
"value": "Liferay Portal 7.2.0 through 7.4.1, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 15, and older unsupported versions does not properly restrict membership of a child site when the \"Limit membership to members of the parent site\" option is enabled, which allows remote authenticated users to add users who are not a member of the parent site to a child site. The added user may obtain permission to perform unauthorized actions in the child site."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863 Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-02-20T07:00:19.650Z",
"orgId": "8b54e794-c6f0-462e-9faa-c1001a673ac3",
"shortName": "Liferay"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25149"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "8b54e794-c6f0-462e-9faa-c1001a673ac3",
"assignerShortName": "Liferay",
"cveId": "CVE-2024-25149",
"datePublished": "2024-02-20T07:00:19.650Z",
"dateReserved": "2024-02-06T10:32:42.567Z",
"dateUpdated": "2024-08-01T23:36:21.703Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2024-26272
Vulnerability from cvelistv5
Published
2024-10-22 14:50
Modified
2024-10-22 15:17
Severity ?
EPSS score ?
Summary
Cross-site request forgery (CSRF) vulnerability in the content page editor in Liferay Portal 7.3.2 through 7.4.3.107, and Liferay DXP 2023.Q4.0 through 2023.Q4.2, 2023.Q3.1 through 2023.Q3.5, 7.4 GA through update 92 and 7.3 GA through update 35 allows remote attackers to (1) change user passwords, (2) shut down the server, (3) execute arbitrary code in the scripting console, (4) and perform other administrative actions via the p_l_back_url parameter.
References
Impacted products
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:liferay:portal:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "portal",
"vendor": "liferay",
"versions": [
{
"lessThanOrEqual": "7.4.3.107",
"status": "affected",
"version": "7.4.0",
"versionType": "maven"
},
{
"lessThanOrEqual": "7.3.7",
"status": "affected",
"version": "7.3.2",
"versionType": "maven"
}
]
},
{
"cpes": [
"cpe:2.3:a:liferay:dxp:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "dxp",
"vendor": "liferay",
"versions": [
{
"lessThanOrEqual": "2023.q4.2",
"status": "affected",
"version": "2023.q4.0",
"versionType": "maven"
},
{
"lessThanOrEqual": "2023.q3.5",
"status": "affected",
"version": "2023.q3.1",
"versionType": "maven"
},
{
"status": "affected",
"version": "7.4"
},
{
"lessThanOrEqual": "update35",
"status": "affected",
"version": "7.3ga",
"versionType": "maven"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-26272",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-10-22T15:15:06.259842Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-10-22T15:17:20.008Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Portal",
"vendor": "Liferay",
"versions": [
{
"lessThanOrEqual": "7.3.7",
"status": "affected",
"version": "7.3.2",
"versionType": "maven"
},
{
"lessThanOrEqual": "7.4.3.107",
"status": "affected",
"version": "7.4.0",
"versionType": "maven"
}
]
},
{
"defaultStatus": "unaffected",
"product": "DXP",
"vendor": "Liferay",
"versions": [
{
"lessThanOrEqual": "7.3.10-u35",
"status": "affected",
"version": "7.3.10",
"versionType": "maven"
},
{
"lessThanOrEqual": "7.4.13-u92",
"status": "affected",
"version": "7.4.13",
"versionType": "maven"
},
{
"lessThanOrEqual": "2023.Q3.5",
"status": "affected",
"version": "2023.Q3.1",
"versionType": "maven"
},
{
"lessThanOrEqual": "2023.Q4.2",
"status": "affected",
"version": "2023.Q4.0",
"versionType": "maven"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Cross-site request forgery (CSRF) vulnerability in the content page editor in Liferay Portal 7.3.2 through 7.4.3.107, and Liferay DXP 2023.Q4.0 through 2023.Q4.2, 2023.Q3.1 through 2023.Q3.5, 7.4 GA through update 92 and 7.3 GA through update 35 allows remote attackers to (1) change user passwords, (2) shut down the server, (3) execute arbitrary code in the scripting console, (4) and perform other administrative actions via the p_l_back_url parameter."
}
],
"value": "Cross-site request forgery (CSRF) vulnerability in the content page editor in Liferay Portal 7.3.2 through 7.4.3.107, and Liferay DXP 2023.Q4.0 through 2023.Q4.2, 2023.Q3.1 through 2023.Q3.5, 7.4 GA through update 92 and 7.3 GA through update 35 allows remote attackers to (1) change user passwords, (2) shut down the server, (3) execute arbitrary code in the scripting console, (4) and perform other administrative actions via the p_l_back_url parameter."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-352",
"description": "CWE-352 Cross-Site Request Forgery (CSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-10-22T14:50:41.505Z",
"orgId": "8b54e794-c6f0-462e-9faa-c1001a673ac3",
"shortName": "Liferay"
},
"references": [
{
"url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2024-26272"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "8b54e794-c6f0-462e-9faa-c1001a673ac3",
"assignerShortName": "Liferay",
"cveId": "CVE-2024-26272",
"datePublished": "2024-10-22T14:50:41.505Z",
"dateReserved": "2024-02-15T07:44:36.776Z",
"dateUpdated": "2024-10-22T15:17:20.008Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2023-33940
Vulnerability from cvelistv5
Published
2023-05-24 13:55
Modified
2024-10-22 15:52
Severity ?
EPSS score ?
Summary
Cross-site scripting (XSS) vulnerability in IFrame type Remote Apps in Liferay Portal 7.4.0 through 7.4.3.30, and Liferay DXP 7.4 before update 31 allows remote attackers to inject arbitrary web script or HTML via the Remote App's IFrame URL.
References
Impacted products
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T15:54:13.784Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-33940"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-33940",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-10-22T15:45:34.553380Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-10-22T15:52:33.662Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Portal",
"vendor": "Liferay",
"versions": [
{
"lessThanOrEqual": "7.4.3.30",
"status": "affected",
"version": "7.4.0",
"versionType": "maven"
}
]
},
{
"defaultStatus": "unaffected",
"product": "DXP",
"vendor": "Liferay",
"versions": [
{
"lessThanOrEqual": "7.4.13.u30",
"status": "affected",
"version": "7.4.13",
"versionType": "maven"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Cross-site scripting (XSS) vulnerability in IFrame type Remote Apps in Liferay Portal 7.4.0 through 7.4.3.30, and Liferay DXP 7.4 before update 31 allows remote attackers to inject arbitrary web script or HTML via the Remote App\u0027s IFrame URL."
}
],
"value": "Cross-site scripting (XSS) vulnerability in IFrame type Remote Apps in Liferay Portal 7.4.0 through 7.4.3.30, and Liferay DXP 7.4 before update 31 allows remote attackers to inject arbitrary web script or HTML via the Remote App\u0027s IFrame URL."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-05-24T13:55:23.431Z",
"orgId": "8b54e794-c6f0-462e-9faa-c1001a673ac3",
"shortName": "Liferay"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-33940"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "8b54e794-c6f0-462e-9faa-c1001a673ac3",
"assignerShortName": "Liferay",
"cveId": "CVE-2023-33940",
"datePublished": "2023-05-24T13:55:23.431Z",
"dateReserved": "2023-05-24T02:36:00.163Z",
"dateUpdated": "2024-10-22T15:52:33.662Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2022-42120
Vulnerability from cvelistv5
Published
2022-11-15 00:00
Modified
2024-08-03 13:03
Severity ?
EPSS score ?
Summary
A SQL injection vulnerability in the Fragment module in Liferay Portal 7.3.3 through 7.4.3.16, and Liferay DXP 7.3 before update 4, and 7.4 before update 17 allows attackers to execute arbitrary SQL commands via a PortletPreferences' `namespace` attribute.
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T13:03:45.509Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "http://liferay.com"
},
{
"tags": [
"x_transferred"
],
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42120"
},
{
"tags": [
"x_transferred"
],
"url": "https://issues.liferay.com/browse/LPE-17513"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A SQL injection vulnerability in the Fragment module in Liferay Portal 7.3.3 through 7.4.3.16, and Liferay DXP 7.3 before update 4, and 7.4 before update 17 allows attackers to execute arbitrary SQL commands via a PortletPreferences\u0027 `namespace` attribute."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-11-15T00:00:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "http://liferay.com"
},
{
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42120"
},
{
"url": "https://issues.liferay.com/browse/LPE-17513"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2022-42120",
"datePublished": "2022-11-15T00:00:00",
"dateReserved": "2022-10-03T00:00:00",
"dateUpdated": "2024-08-03T13:03:45.509Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2023-5190
Vulnerability from cvelistv5
Published
2024-02-20 06:03
Modified
2024-08-02 07:52
Severity ?
EPSS score ?
Summary
Open redirect vulnerability in the Countries Management’s edit region page in Liferay Portal 7.4.3.45 through 7.4.3.101, and Liferay DXP 2023.Q3 before patch 6, and 7.4 update 45 through 92 allows remote attackers to redirect users to arbitrary external URLs via the _com_liferay_address_web_internal_portlet_CountriesManagementAdminPortlet_redirect parameter.
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-5190",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-02-20T18:29:08.593069Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-07-05T17:21:47.322Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T07:52:07.791Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-5190"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Portal",
"vendor": "Liferay",
"versions": [
{
"lessThanOrEqual": "7.4.3.101",
"status": "affected",
"version": "7.4.3.45",
"versionType": "maven"
}
]
},
{
"defaultStatus": "unaffected",
"product": "DXP",
"vendor": "Liferay",
"versions": [
{
"lessThanOrEqual": "2023.q3.5",
"status": "affected",
"version": "2023.q3.1",
"versionType": "maven"
},
{
"lessThanOrEqual": "7.4.13.u92",
"status": "affected",
"version": "7.4.13.u45",
"versionType": "maven"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"user": "00000000-0000-4000-9000-000000000000",
"value": "Amin ACHOUR"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Open redirect vulnerability in the Countries Management\u2019s edit region page in Liferay Portal 7.4.3.45 through 7.4.3.101, and Liferay DXP 2023.Q3 before patch 6, and 7.4 update 45 through 92 allows remote attackers to redirect users to arbitrary external URLs via the _com_liferay_address_web_internal_portlet_CountriesManagementAdminPortlet_redirect parameter."
}
],
"value": "Open redirect vulnerability in the Countries Management\u2019s edit region page in Liferay Portal 7.4.3.45 through 7.4.3.101, and Liferay DXP 2023.Q3 before patch 6, and 7.4 update 45 through 92 allows remote attackers to redirect users to arbitrary external URLs via the _com_liferay_address_web_internal_portlet_CountriesManagementAdminPortlet_redirect parameter."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-601",
"description": "CWE-601 URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-02-20T06:03:45.941Z",
"orgId": "8b54e794-c6f0-462e-9faa-c1001a673ac3",
"shortName": "Liferay"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-5190"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "8b54e794-c6f0-462e-9faa-c1001a673ac3",
"assignerShortName": "Liferay",
"cveId": "CVE-2023-5190",
"datePublished": "2024-02-20T06:03:45.941Z",
"dateReserved": "2023-09-26T05:30:24.925Z",
"dateUpdated": "2024-08-02T07:52:07.791Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2022-42119
Vulnerability from cvelistv5
Published
2022-11-15 00:00
Modified
2024-08-03 13:03
Severity ?
EPSS score ?
Summary
Certain Liferay products are vulnerable to Cross Site Scripting (XSS) via the Commerce module. This affects Liferay Portal 7.3.5 through 7.4.2 and Liferay DXP 7.3 before update 8.
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T13:03:45.180Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "http://liferay.com"
},
{
"tags": [
"x_transferred"
],
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42119"
},
{
"tags": [
"x_transferred"
],
"url": "https://issues.liferay.com/browse/LPE-17632"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Certain Liferay products are vulnerable to Cross Site Scripting (XSS) via the Commerce module. This affects Liferay Portal 7.3.5 through 7.4.2 and Liferay DXP 7.3 before update 8."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-11-15T00:00:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "http://liferay.com"
},
{
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42119"
},
{
"url": "https://issues.liferay.com/browse/LPE-17632"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2022-42119",
"datePublished": "2022-11-15T00:00:00",
"dateReserved": "2022-10-03T00:00:00",
"dateUpdated": "2024-08-03T13:03:45.180Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2023-42496
Vulnerability from cvelistv5
Published
2024-02-21 02:21
Modified
2024-08-02 19:23
Severity ?
EPSS score ?
Summary
Reflected cross-site scripting (XSS) vulnerability on the add assignees to a role page in Liferay Portal 7.3.3 through 7.4.3.97, and Liferay DXP 2023.Q3 before patch 6, 7.4 GA through update 92, and 7.3 before update 34 allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_roles_admin_web_portlet_RolesAdminPortlet_tabs2 parameter.
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-42496",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-02-21T16:07:22.225984Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-07-05T17:21:50.222Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T19:23:39.433Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-42496"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Portal",
"vendor": "Liferay",
"versions": [
{
"lessThanOrEqual": "7.4.3.97",
"status": "affected",
"version": "7.3.3",
"versionType": "maven"
}
]
},
{
"defaultStatus": "unaffected",
"product": "DXP",
"vendor": "Liferay",
"versions": [
{
"lessThanOrEqual": "2023.q3.5",
"status": "affected",
"version": "2023.q3.1",
"versionType": "maven"
},
{
"lessThanOrEqual": "7.4.13.u92",
"status": "affected",
"version": "7.4.13",
"versionType": "maven"
},
{
"lessThanOrEqual": "7.3.10-dxp-33",
"status": "affected",
"version": "7.3.10",
"versionType": "maven"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"user": "00000000-0000-4000-9000-000000000000",
"value": "Amin ACHOUR"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Reflected cross-site scripting (XSS) vulnerability on the add assignees to a role page in Liferay Portal 7.3.3 through 7.4.3.97, and Liferay DXP 2023.Q3 before patch 6, 7.4 GA through update 92, and 7.3 before update 34 allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_roles_admin_web_portlet_RolesAdminPortlet_tabs2 parameter."
}
],
"value": "Reflected cross-site scripting (XSS) vulnerability on the add assignees to a role page in Liferay Portal 7.3.3 through 7.4.3.97, and Liferay DXP 2023.Q3 before patch 6, 7.4 GA through update 92, and 7.3 before update 34 allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_roles_admin_web_portlet_RolesAdminPortlet_tabs2 parameter."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.6,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-02-21T02:21:01.515Z",
"orgId": "8b54e794-c6f0-462e-9faa-c1001a673ac3",
"shortName": "Liferay"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-42496"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "8b54e794-c6f0-462e-9faa-c1001a673ac3",
"assignerShortName": "Liferay",
"cveId": "CVE-2023-42496",
"datePublished": "2024-02-21T02:21:01.515Z",
"dateReserved": "2023-09-11T08:54:24.311Z",
"dateUpdated": "2024-08-02T19:23:39.433Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2023-33941
Vulnerability from cvelistv5
Published
2023-05-24 14:36
Modified
2024-10-22 15:52
Severity ?
EPSS score ?
Summary
Multiple cross-site scripting (XSS) vulnerabilities in the Plugin for OAuth 2.0 module's OAuth2ProviderApplicationRedirect class in Liferay Portal 7.4.3.41 through 7.4.3.52, and Liferay DXP 7.4 update 41 through 52 allow remote attackers to inject arbitrary web script or HTML via the (1) code, or (2) error parameter.
References
Impacted products
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T15:54:13.782Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-33941"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-33941",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-10-22T15:47:35.864239Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-10-22T15:52:26.805Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Portal",
"vendor": "Liferay",
"versions": [
{
"lessThanOrEqual": "7.4.3.52",
"status": "affected",
"version": "7.4.3.41",
"versionType": "maven"
}
]
},
{
"defaultStatus": "unaffected",
"product": "DXP",
"vendor": "Liferay",
"versions": [
{
"lessThanOrEqual": "7.4.13.u52",
"status": "affected",
"version": "7.4.13.u41",
"versionType": "maven"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in the Plugin for OAuth 2.0 module\u0027s OAuth2ProviderApplicationRedirect class in Liferay Portal 7.4.3.41 through 7.4.3.52, and Liferay DXP 7.4 update 41 through 52 allow remote attackers to inject arbitrary web script or HTML via the (1) code, or (2) error parameter."
}
],
"value": "Multiple cross-site scripting (XSS) vulnerabilities in the Plugin for OAuth 2.0 module\u0027s OAuth2ProviderApplicationRedirect class in Liferay Portal 7.4.3.41 through 7.4.3.52, and Liferay DXP 7.4 update 41 through 52 allow remote attackers to inject arbitrary web script or HTML via the (1) code, or (2) error parameter."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-05-24T14:36:07.977Z",
"orgId": "8b54e794-c6f0-462e-9faa-c1001a673ac3",
"shortName": "Liferay"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-33941"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "8b54e794-c6f0-462e-9faa-c1001a673ac3",
"assignerShortName": "Liferay",
"cveId": "CVE-2023-33941",
"datePublished": "2023-05-24T14:36:07.977Z",
"dateReserved": "2023-05-24T02:36:00.163Z",
"dateUpdated": "2024-10-22T15:52:26.805Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2024-25602
Vulnerability from cvelistv5
Published
2024-02-21 01:45
Modified
2024-08-01 23:44
Severity ?
EPSS score ?
Summary
Stored cross-site scripting (XSS) vulnerability in Users Admin module's edit user page in Liferay Portal 7.2.0 through 7.4.2, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 17, and older unsupported versions allows remote authenticated users to inject arbitrary web script or HTML via a crafted payload injected into an organization’s “Name” text field
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-25602",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-02-21T15:23:34.173155Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-07-05T17:20:59.028Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-01T23:44:09.672Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25602"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Portal",
"vendor": "Liferay",
"versions": [
{
"lessThanOrEqual": "7.4.2",
"status": "affected",
"version": "7.2.0",
"versionType": "maven"
}
]
},
{
"defaultStatus": "unknown",
"product": "DXP",
"vendor": "Liferay",
"versions": [
{
"lessThanOrEqual": "7.3.10-dxp-2",
"status": "affected",
"version": "7.3.10",
"versionType": "maven"
},
{
"lessThanOrEqual": "7.2.10-dxp-16",
"status": "affected",
"version": "7.2.10",
"versionType": "maven"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Stored cross-site scripting (XSS) vulnerability in Users Admin module\u0027s edit user page in Liferay Portal 7.2.0 through 7.4.2, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 17, and older unsupported versions allows remote authenticated users to inject arbitrary web script or HTML via a crafted payload injected into an organization\u2019s \u201cName\u201d text field"
}
],
"value": "Stored cross-site scripting (XSS) vulnerability in Users Admin module\u0027s edit user page in Liferay Portal 7.2.0 through 7.4.2, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 17, and older unsupported versions allows remote authenticated users to inject arbitrary web script or HTML via a crafted payload injected into an organization\u2019s \u201cName\u201d text field"
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-02-21T01:45:15.312Z",
"orgId": "8b54e794-c6f0-462e-9faa-c1001a673ac3",
"shortName": "Liferay"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25602"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "8b54e794-c6f0-462e-9faa-c1001a673ac3",
"assignerShortName": "Liferay",
"cveId": "CVE-2024-25602",
"datePublished": "2024-02-21T01:45:15.312Z",
"dateReserved": "2024-02-08T13:57:11.425Z",
"dateUpdated": "2024-08-01T23:44:09.672Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2023-47795
Vulnerability from cvelistv5
Published
2024-02-21 14:01
Modified
2024-08-02 21:16
Severity ?
EPSS score ?
Summary
Stored cross-site scripting (XSS) vulnerability in the Document and Media widget in Liferay Portal 7.4.3.18 through 7.4.3.101, and Liferay DXP 2023.Q3 before patch 6, and 7.4 update 18 through 92 allows remote authenticated users to inject arbitrary web script or HTML via a crafted payload injected into a document's “Title” text field.
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-47795",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-02-21T18:14:14.835953Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-07-05T17:20:59.522Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T21:16:43.666Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-47795"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Portal",
"vendor": "Liferay",
"versions": [
{
"lessThanOrEqual": "7.4.3.101",
"status": "affected",
"version": "7.4.3.18",
"versionType": "maven"
}
]
},
{
"defaultStatus": "unaffected",
"product": "DXP",
"vendor": "Liferay",
"versions": [
{
"lessThanOrEqual": "2023.q3.5",
"status": "affected",
"version": "2023.q3.1",
"versionType": "maven"
},
{
"lessThanOrEqual": "7.4.13.u92",
"status": "affected",
"version": "7.4.13.u18",
"versionType": "maven"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"user": "00000000-0000-4000-9000-000000000000",
"value": "Erwin Krazek"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Stored cross-site scripting (XSS) vulnerability in the Document and Media widget in Liferay Portal 7.4.3.18 through 7.4.3.101, and Liferay DXP 2023.Q3 before patch 6, and 7.4 update 18 through 92 allows remote authenticated users to inject arbitrary web script or HTML via a crafted payload injected into a document\u0027s \u201cTitle\u201d text field."
}
],
"value": "Stored cross-site scripting (XSS) vulnerability in the Document and Media widget in Liferay Portal 7.4.3.18 through 7.4.3.101, and Liferay DXP 2023.Q3 before patch 6, and 7.4 update 18 through 92 allows remote authenticated users to inject arbitrary web script or HTML via a crafted payload injected into a document\u0027s \u201cTitle\u201d text field."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-02-21T14:01:00.773Z",
"orgId": "8b54e794-c6f0-462e-9faa-c1001a673ac3",
"shortName": "Liferay"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-47795"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "8b54e794-c6f0-462e-9faa-c1001a673ac3",
"assignerShortName": "Liferay",
"cveId": "CVE-2023-47795",
"datePublished": "2024-02-21T14:01:00.773Z",
"dateReserved": "2023-11-10T01:49:20.188Z",
"dateUpdated": "2024-08-02T21:16:43.666Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2024-25610
Vulnerability from cvelistv5
Published
2024-02-20 12:42
Modified
2024-08-28 13:37
Severity ?
EPSS score ?
Summary
In Liferay Portal 7.2.0 through 7.4.3.12, and older unsupported versions, and Liferay DXP 7.4 before update 9, 7.3 before update 4, 7.2 before fix pack 19, and older unsupported versions, the default configuration does not sanitize blog entries of JavaScript, which allows remote authenticated users to inject arbitrary web script or HTML (XSS) via a crafted payload injected into a blog entry’s content text field.
References
Impacted products
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-01T23:44:09.718Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25610"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"cpes": [
"cpe:2.3:a:liferay:portal:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "portal",
"vendor": "liferay",
"versions": [
{
"lessThanOrEqual": "7.4.3.12",
"status": "affected",
"version": "7.2.0",
"versionType": "maven"
}
]
},
{
"cpes": [
"cpe:2.3:a:liferay:digital_experience_platform:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "digital_experience_platform",
"vendor": "liferay",
"versions": [
{
"lessThanOrEqual": "7.2.10-dxp-18",
"status": "affected",
"version": "7.2.10",
"versionType": "maven"
},
{
"lessThanOrEqual": "7.3.10-dxp-3",
"status": "affected",
"version": "7.3.10",
"versionType": "maven"
},
{
"lessThanOrEqual": "7.4.13.u8",
"status": "affected",
"version": "7.4.13",
"versionType": "maven"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-25610",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-08-28T13:32:33.811894Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-08-28T13:37:03.603Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Portal",
"vendor": "Liferay",
"versions": [
{
"lessThanOrEqual": "7.4.3.12",
"status": "affected",
"version": "7.2.0",
"versionType": "maven"
}
]
},
{
"defaultStatus": "unknown",
"product": "DXP",
"vendor": "Liferay",
"versions": [
{
"lessThanOrEqual": "7.4.13.u8",
"status": "affected",
"version": "7.4.13",
"versionType": "maven"
},
{
"lessThanOrEqual": "7.3.10-dxp-3",
"status": "affected",
"version": "7.3.10",
"versionType": "maven"
},
{
"lessThanOrEqual": "7.2.10-dxp-18",
"status": "affected",
"version": "7.2.10",
"versionType": "maven"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "In Liferay Portal 7.2.0 through 7.4.3.12, and older unsupported versions, and Liferay DXP 7.4 before update 9, 7.3 before update 4, 7.2 before fix pack 19, and older unsupported versions, the default configuration does not sanitize blog entries of JavaScript, which allows remote authenticated users to inject arbitrary web script or HTML (XSS) via a crafted payload injected into a blog entry\u2019s content text field."
}
],
"value": "In Liferay Portal 7.2.0 through 7.4.3.12, and older unsupported versions, and Liferay DXP 7.4 before update 9, 7.3 before update 4, 7.2 before fix pack 19, and older unsupported versions, the default configuration does not sanitize blog entries of JavaScript, which allows remote authenticated users to inject arbitrary web script or HTML (XSS) via a crafted payload injected into a blog entry\u2019s content text field."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1188",
"description": "CWE-1188 Insecure Default Initialization of Resource",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-02-20T12:42:46.027Z",
"orgId": "8b54e794-c6f0-462e-9faa-c1001a673ac3",
"shortName": "Liferay"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25610"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "8b54e794-c6f0-462e-9faa-c1001a673ac3",
"assignerShortName": "Liferay",
"cveId": "CVE-2024-25610",
"datePublished": "2024-02-20T12:42:46.027Z",
"dateReserved": "2024-02-08T13:57:11.426Z",
"dateUpdated": "2024-08-28T13:37:03.603Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2023-33938
Vulnerability from cvelistv5
Published
2023-05-24 13:20
Modified
2024-10-22 15:52
Severity ?
EPSS score ?
Summary
Cross-site scripting (XSS) vulnerability in the App Builder module's custom object details page in Liferay Portal 7.3.0 through 7.4.0, and Liferay DXP 7.3 before update 14 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into an App Builder custom object's `Name` field.
References
Impacted products
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T15:54:13.714Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-33938"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-33938",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-10-22T15:46:09.421886Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-10-22T15:52:48.350Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Portal",
"vendor": "Liferay",
"versions": [
{
"lessThanOrEqual": "7.4.0",
"status": "affected",
"version": "7.3.0",
"versionType": "maven"
}
]
},
{
"defaultStatus": "unaffected",
"product": "DXP",
"vendor": "Liferay",
"versions": [
{
"lessThanOrEqual": "7.3.10.u13",
"status": "affected",
"version": "7.3.10",
"versionType": "maven"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Cross-site scripting (XSS) vulnerability in the App Builder module\u0027s custom object details page in Liferay Portal 7.3.0 through 7.4.0, and Liferay DXP 7.3 before update 14 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into an App Builder custom object\u0027s `Name` field."
}
],
"value": "Cross-site scripting (XSS) vulnerability in the App Builder module\u0027s custom object details page in Liferay Portal 7.3.0 through 7.4.0, and Liferay DXP 7.3 before update 14 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into an App Builder custom object\u0027s `Name` field."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-05-24T13:20:19.626Z",
"orgId": "8b54e794-c6f0-462e-9faa-c1001a673ac3",
"shortName": "Liferay"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-33938"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "8b54e794-c6f0-462e-9faa-c1001a673ac3",
"assignerShortName": "Liferay",
"cveId": "CVE-2023-33938",
"datePublished": "2023-05-24T13:20:19.626Z",
"dateReserved": "2023-05-24T02:36:00.163Z",
"dateUpdated": "2024-10-22T15:52:48.350Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2021-33331
Vulnerability from cvelistv5
Published
2021-08-03 20:43
Modified
2024-08-03 23:50
Severity ?
EPSS score ?
Summary
Open redirect vulnerability in the Notifications module in Liferay Portal 7.0.0 through 7.3.1, and Liferay DXP 7.0 before fix pack 94, 7.1 before fix pack 19 and 7.2 before fix pack 8, allows remote attackers to redirect users to arbitrary external URLs via the 'redirect' parameter.
References
| ▼ | URL | Tags |
|---|---|---|
| https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120747627 | x_refsource_CONFIRM | |
| https://issues.liferay.com/browse/LPE-17022 | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T23:50:41.593Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120747627"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://issues.liferay.com/browse/LPE-17022"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Open redirect vulnerability in the Notifications module in Liferay Portal 7.0.0 through 7.3.1, and Liferay DXP 7.0 before fix pack 94, 7.1 before fix pack 19 and 7.2 before fix pack 8, allows remote attackers to redirect users to arbitrary external URLs via the \u0027redirect\u0027 parameter."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-08-03T20:43:55",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120747627"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://issues.liferay.com/browse/LPE-17022"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2021-33331",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Open redirect vulnerability in the Notifications module in Liferay Portal 7.0.0 through 7.3.1, and Liferay DXP 7.0 before fix pack 94, 7.1 before fix pack 19 and 7.2 before fix pack 8, allows remote attackers to redirect users to arbitrary external URLs via the \u0027redirect\u0027 parameter."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120747627",
"refsource": "CONFIRM",
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120747627"
},
{
"name": "https://issues.liferay.com/browse/LPE-17022",
"refsource": "CONFIRM",
"url": "https://issues.liferay.com/browse/LPE-17022"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2021-33331",
"datePublished": "2021-08-03T20:43:55",
"dateReserved": "2021-05-20T00:00:00",
"dateUpdated": "2024-08-03T23:50:41.593Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2021-33333
Vulnerability from cvelistv5
Published
2021-08-03 20:47
Modified
2024-08-03 23:50
Severity ?
EPSS score ?
Summary
The Portal Workflow module in Liferay Portal 7.3.2 and earlier, and Liferay DXP 7.0 before fix pack 93, 7.1 before fix pack 19 and 7.2 before fix pack 6, does not properly check user permission, which allows remote authenticated users to view and delete workflow submissions via crafted URLs.
References
| ▼ | URL | Tags |
|---|---|---|
| https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120747742 | x_refsource_CONFIRM | |
| https://issues.liferay.com/browse/LPE-17032 | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T23:50:41.583Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120747742"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://issues.liferay.com/browse/LPE-17032"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The Portal Workflow module in Liferay Portal 7.3.2 and earlier, and Liferay DXP 7.0 before fix pack 93, 7.1 before fix pack 19 and 7.2 before fix pack 6, does not properly check user permission, which allows remote authenticated users to view and delete workflow submissions via crafted URLs."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-08-03T20:47:50",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120747742"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://issues.liferay.com/browse/LPE-17032"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2021-33333",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The Portal Workflow module in Liferay Portal 7.3.2 and earlier, and Liferay DXP 7.0 before fix pack 93, 7.1 before fix pack 19 and 7.2 before fix pack 6, does not properly check user permission, which allows remote authenticated users to view and delete workflow submissions via crafted URLs."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120747742",
"refsource": "CONFIRM",
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120747742"
},
{
"name": "https://issues.liferay.com/browse/LPE-17032",
"refsource": "CONFIRM",
"url": "https://issues.liferay.com/browse/LPE-17032"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2021-33333",
"datePublished": "2021-08-03T20:47:50",
"dateReserved": "2021-05-20T00:00:00",
"dateUpdated": "2024-08-03T23:50:41.583Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2024-25150
Vulnerability from cvelistv5
Published
2024-02-20 08:11
Modified
2024-08-01 23:36
Severity ?
EPSS score ?
Summary
Information disclosure vulnerability in the Control Panel in Liferay Portal 7.2.0 through 7.4.2, and older unsupported versions, and Liferay DXP 7.3 before update 4, 7.2 before fix pack 19, and older unsupported versions allows remote authenticated users to obtain a user's full name from the page's title by enumerating user screen names.
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-25150",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-02-20T14:56:08.054595Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-07-05T17:20:56.883Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-01T23:36:21.623Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25150"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Portal",
"vendor": "Liferay",
"versions": [
{
"lessThanOrEqual": "7.4.2",
"status": "affected",
"version": "7.2.0",
"versionType": "maven"
}
]
},
{
"defaultStatus": "unknown",
"product": "DXP",
"vendor": "Liferay",
"versions": [
{
"lessThanOrEqual": "7.3.10-dxp-3",
"status": "affected",
"version": "7.3.10",
"versionType": "maven"
},
{
"lessThanOrEqual": "7.2.10-dxp-18",
"status": "affected",
"version": "7.2.10",
"versionType": "maven"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"user": "00000000-0000-4000-9000-000000000000",
"value": "Sahil Mehra"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Information disclosure vulnerability in the Control Panel in Liferay Portal 7.2.0 through 7.4.2, and older unsupported versions, and Liferay DXP 7.3 before update 4, 7.2 before fix pack 19, and older unsupported versions allows remote authenticated users to obtain a user\u0027s full name from the page\u0027s title by enumerating user screen names."
}
],
"value": "Information disclosure vulnerability in the Control Panel in Liferay Portal 7.2.0 through 7.4.2, and older unsupported versions, and Liferay DXP 7.3 before update 4, 7.2 before fix pack 19, and older unsupported versions allows remote authenticated users to obtain a user\u0027s full name from the page\u0027s title by enumerating user screen names."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-201",
"description": "CWE-201 Insertion of Sensitive Information Into Sent Data",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-02-20T08:11:28.312Z",
"orgId": "8b54e794-c6f0-462e-9faa-c1001a673ac3",
"shortName": "Liferay"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25150"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "8b54e794-c6f0-462e-9faa-c1001a673ac3",
"assignerShortName": "Liferay",
"cveId": "CVE-2024-25150",
"datePublished": "2024-02-20T08:11:28.312Z",
"dateReserved": "2024-02-06T10:32:42.567Z",
"dateUpdated": "2024-08-01T23:36:21.623Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2021-29043
Vulnerability from cvelistv5
Published
2021-05-17 10:48
Modified
2024-08-03 21:55
Severity ?
EPSS score ?
Summary
The Portal Store module in Liferay Portal 7.0.0 through 7.3.5, and Liferay DXP 7.0 before fix pack 97, 7.1 before fix pack 21, 7.2 before fix pack 10 and 7.3 before fix pack 1 does not obfuscate the S3 store's proxy password, which allows attackers to steal the proxy password via man-in-the-middle attacks or shoulder surfing.
References
| ▼ | URL | Tags |
|---|---|---|
| http://liferay.com | x_refsource_MISC | |
| https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120743515 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T21:55:12.547Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://liferay.com"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120743515"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The Portal Store module in Liferay Portal 7.0.0 through 7.3.5, and Liferay DXP 7.0 before fix pack 97, 7.1 before fix pack 21, 7.2 before fix pack 10 and 7.3 before fix pack 1 does not obfuscate the S3 store\u0027s proxy password, which allows attackers to steal the proxy password via man-in-the-middle attacks or shoulder surfing."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-05-17T10:48:12",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "http://liferay.com"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120743515"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2021-29043",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The Portal Store module in Liferay Portal 7.0.0 through 7.3.5, and Liferay DXP 7.0 before fix pack 97, 7.1 before fix pack 21, 7.2 before fix pack 10 and 7.3 before fix pack 1 does not obfuscate the S3 store\u0027s proxy password, which allows attackers to steal the proxy password via man-in-the-middle attacks or shoulder surfing."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://liferay.com",
"refsource": "MISC",
"url": "http://liferay.com"
},
{
"name": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120743515",
"refsource": "MISC",
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120743515"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2021-29043",
"datePublished": "2021-05-17T10:48:12",
"dateReserved": "2021-03-22T00:00:00",
"dateUpdated": "2024-08-03T21:55:12.547Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2023-40191
Vulnerability from cvelistv5
Published
2024-02-21 03:06
Modified
2024-08-02 18:24
Severity ?
EPSS score ?
Summary
Reflected cross-site scripting (XSS) vulnerability in the instance settings for Accounts in Liferay Portal 7.4.3.44 through 7.4.3.97, and Liferay DXP 2023.Q3 before patch 6, and 7.4 update 44 through 92 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into the “Blocked Email Domains” text field
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-40191",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-02-21T16:04:15.992539Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-07-05T17:21:49.977Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T18:24:55.603Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-40191"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Portal",
"vendor": "Liferay",
"versions": [
{
"lessThanOrEqual": "7.4.3.97",
"status": "affected",
"version": "7.4.3.44",
"versionType": "maven"
}
]
},
{
"defaultStatus": "unaffected",
"product": "DXP",
"vendor": "Liferay",
"versions": [
{
"lessThanOrEqual": "2023.q3.5",
"status": "affected",
"version": "2023.q3.1",
"versionType": "maven"
},
{
"lessThanOrEqual": "7.4.13.u92",
"status": "affected",
"version": "7.4.13.u44",
"versionType": "maven"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"user": "00000000-0000-4000-9000-000000000000",
"value": "Amin ACHOUR"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Reflected cross-site scripting (XSS) vulnerability in the instance settings for Accounts in Liferay Portal 7.4.3.44 through 7.4.3.97, and Liferay DXP 2023.Q3 before patch 6, and 7.4 update 44 through 92 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into the \u201cBlocked Email Domains\u201d text field"
}
],
"value": "Reflected cross-site scripting (XSS) vulnerability in the instance settings for Accounts in Liferay Portal 7.4.3.44 through 7.4.3.97, and Liferay DXP 2023.Q3 before patch 6, and 7.4 update 44 through 92 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into the \u201cBlocked Email Domains\u201d text field"
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-02-21T03:06:30.224Z",
"orgId": "8b54e794-c6f0-462e-9faa-c1001a673ac3",
"shortName": "Liferay"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-40191"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "8b54e794-c6f0-462e-9faa-c1001a673ac3",
"assignerShortName": "Liferay",
"cveId": "CVE-2023-40191",
"datePublished": "2024-02-21T03:06:30.224Z",
"dateReserved": "2023-08-10T07:17:26.967Z",
"dateUpdated": "2024-08-02T18:24:55.603Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2024-25151
Vulnerability from cvelistv5
Published
2024-02-21 03:17
Modified
2024-08-01 23:36
Severity ?
EPSS score ?
Summary
The Calendar module in Liferay Portal 7.2.0 through 7.4.2, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 15, and older unsupported versions does not escape user supplied data in the default notification email template, which allows remote authenticated users to inject arbitrary web script or HTML via the title of a calendar event or the user's name. This may lead to a content spoofing or cross-site scripting (XSS) attacks depending on the capability of the receiver's mail client.
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-25151",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-02-21T19:59:16.285131Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-07-05T17:21:00.161Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-01T23:36:21.643Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25151"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Portal",
"vendor": "Liferay",
"versions": [
{
"lessThanOrEqual": "7.4.2",
"status": "affected",
"version": "7.2.0",
"versionType": "maven"
}
]
},
{
"defaultStatus": "unknown",
"product": "DXP",
"vendor": "Liferay",
"versions": [
{
"lessThanOrEqual": "7.3.10-dxp-2",
"status": "affected",
"version": "7.3.10",
"versionType": "maven"
},
{
"lessThanOrEqual": "7.2.10-dxp-14",
"status": "affected",
"version": "7.2.10",
"versionType": "maven"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The Calendar module in Liferay Portal 7.2.0 through 7.4.2, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 15, and older unsupported versions does not escape user supplied data in the default notification email template, which allows remote authenticated users to inject arbitrary web script or HTML via the title of a calendar event or the user\u0027s name. This may lead to a content spoofing or cross-site scripting (XSS) attacks depending on the capability of the receiver\u0027s mail client."
}
],
"value": "The Calendar module in Liferay Portal 7.2.0 through 7.4.2, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 15, and older unsupported versions does not escape user supplied data in the default notification email template, which allows remote authenticated users to inject arbitrary web script or HTML via the title of a calendar event or the user\u0027s name. This may lead to a content spoofing or cross-site scripting (XSS) attacks depending on the capability of the receiver\u0027s mail client."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-02-21T03:17:37.167Z",
"orgId": "8b54e794-c6f0-462e-9faa-c1001a673ac3",
"shortName": "Liferay"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25151"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "8b54e794-c6f0-462e-9faa-c1001a673ac3",
"assignerShortName": "Liferay",
"cveId": "CVE-2024-25151",
"datePublished": "2024-02-21T03:17:37.167Z",
"dateReserved": "2024-02-06T10:32:42.567Z",
"dateUpdated": "2024-08-01T23:36:21.643Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2024-25148
Vulnerability from cvelistv5
Published
2024-02-08 03:43
Modified
2024-10-02 15:34
Severity ?
EPSS score ?
Summary
In Liferay Portal 7.2.0 through 7.4.1, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 15, and older unsupported versions the `doAsUserId` URL parameter may get leaked when creating linked content using the WYSIWYG editor and while impersonating a user. This may allow remote authenticated users to impersonate a user after accessing the linked content.
References
Impacted products
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-01T23:36:21.792Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25148"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-25148",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-08-21T17:33:36.777108Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-08-21T17:33:47.793Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Portal",
"vendor": "Liferay",
"versions": [
{
"lessThanOrEqual": "7.4.1",
"status": "affected",
"version": "7.2.0",
"versionType": "maven"
}
]
},
{
"defaultStatus": "unknown",
"product": "DXP",
"vendor": "Liferay",
"versions": [
{
"lessThanOrEqual": "7.3.10-dxp-2",
"status": "affected",
"version": "7.3.10",
"versionType": "maven"
},
{
"lessThanOrEqual": "7.2.10-dxp-14",
"status": "affected",
"version": "7.2.10",
"versionType": "maven"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "In Liferay Portal 7.2.0 through 7.4.1, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 15, and older unsupported versions the `doAsUserId` URL parameter may get leaked when creating linked content using the WYSIWYG editor and while impersonating a user. This may allow remote authenticated users to impersonate a user after accessing the linked content."
}
],
"value": "In Liferay Portal 7.2.0 through 7.4.1, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 15, and older unsupported versions the `doAsUserId` URL parameter may get leaked when creating linked content using the WYSIWYG editor and while impersonating a user. This may allow remote authenticated users to impersonate a user after accessing the linked content."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-201",
"description": "CWE-201: Insertion of Sensitive Information Into Sent Data",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-10-02T15:34:33.761Z",
"orgId": "8b54e794-c6f0-462e-9faa-c1001a673ac3",
"shortName": "Liferay"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25148"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "8b54e794-c6f0-462e-9faa-c1001a673ac3",
"assignerShortName": "Liferay",
"cveId": "CVE-2024-25148",
"datePublished": "2024-02-08T03:43:14.148Z",
"dateReserved": "2024-02-06T10:32:42.567Z",
"dateUpdated": "2024-10-02T15:34:33.761Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2024-26265
Vulnerability from cvelistv5
Published
2024-02-20 12:51
Modified
2024-10-02 15:35
Severity ?
EPSS score ?
Summary
The Image Uploader module in Liferay Portal 7.2.0 through 7.4.3.15, and older unsupported versions, and Liferay DXP 7.4 before update 16, 7.3 before update 4, 7.2 before fix pack 19, and older unsupported versions relies on a request parameter to limit the size of files that can be uploaded, which allows remote authenticated users to upload arbitrarily large files to the system's temp folder by modifying the `maxFileSize` parameter.
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-26265",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-02-21T19:41:28.464221Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-04T17:48:44.628Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T00:07:17.892Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-26265"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Portal",
"vendor": "Liferay",
"versions": [
{
"lessThanOrEqual": "7.4.3.15",
"status": "affected",
"version": "7.2.0",
"versionType": "maven"
}
]
},
{
"defaultStatus": "unknown",
"product": "DXP",
"vendor": "Liferay",
"versions": [
{
"lessThanOrEqual": "7.4.13.u15",
"status": "affected",
"version": "7.4.13",
"versionType": "maven"
},
{
"lessThanOrEqual": "7.3.10-dxp-3",
"status": "affected",
"version": "7.3.10",
"versionType": "maven"
},
{
"lessThanOrEqual": "7.2.10-dxp-18",
"status": "affected",
"version": "7.2.10",
"versionType": "maven"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The Image Uploader module in Liferay Portal 7.2.0 through 7.4.3.15, and older unsupported versions, and Liferay DXP 7.4 before update 16, 7.3 before update 4, 7.2 before fix pack 19, and older unsupported versions relies on a request parameter to limit the size of files that can be uploaded, which allows remote authenticated users to upload arbitrarily large files to the system\u0027s temp folder by modifying the `maxFileSize` parameter."
}
],
"value": "The Image Uploader module in Liferay Portal 7.2.0 through 7.4.3.15, and older unsupported versions, and Liferay DXP 7.4 before update 16, 7.3 before update 4, 7.2 before fix pack 19, and older unsupported versions relies on a request parameter to limit the size of files that can be uploaded, which allows remote authenticated users to upload arbitrarily large files to the system\u0027s temp folder by modifying the `maxFileSize` parameter."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "CWE-770 Allocation of Resources Without Limits or Throttling",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-10-02T15:35:51.464Z",
"orgId": "8b54e794-c6f0-462e-9faa-c1001a673ac3",
"shortName": "Liferay"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-26265"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "8b54e794-c6f0-462e-9faa-c1001a673ac3",
"assignerShortName": "Liferay",
"cveId": "CVE-2024-26265",
"datePublished": "2024-02-20T12:51:48.261Z",
"dateReserved": "2024-02-15T07:44:36.776Z",
"dateUpdated": "2024-10-02T15:35:51.464Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2022-42114
Vulnerability from cvelistv5
Published
2022-10-18 00:00
Modified
2024-08-03 13:03
Severity ?
EPSS score ?
Summary
A Cross-site scripting (XSS) vulnerability in the Role module's edit role assignees page in Liferay Portal 7.4.0 through 7.4.3.36, and Liferay DXP 7.4 before update 37 allows remote attackers to inject arbitrary web script or HTML.
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T13:03:44.095Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "http://liferay.com"
},
{
"tags": [
"x_transferred"
],
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42114"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A Cross-site scripting (XSS) vulnerability in the Role module\u0027s edit role assignees page in Liferay Portal 7.4.0 through 7.4.3.36, and Liferay DXP 7.4 before update 37 allows remote attackers to inject arbitrary web script or HTML."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-10-18T00:00:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "http://liferay.com"
},
{
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42114"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2022-42114",
"datePublished": "2022-10-18T00:00:00",
"dateReserved": "2022-10-03T00:00:00",
"dateUpdated": "2024-08-03T13:03:44.095Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2022-42112
Vulnerability from cvelistv5
Published
2022-10-18 00:00
Modified
2024-08-03 13:03
Severity ?
EPSS score ?
Summary
A Cross-site scripting (XSS) vulnerability in the Portal Search module's Sort widget in Liferay Portal 7.2.0 through 7.4.3.24, and Liferay DXP 7.2 before fix pack 19, 7.3 before update 5, and DXP 7.4 before update 25 allows remote attackers to inject arbitrary web script or HTML via a crafted payload.
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T13:03:45.719Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "http://liferay.com"
},
{
"tags": [
"x_transferred"
],
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42112"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A Cross-site scripting (XSS) vulnerability in the Portal Search module\u0027s Sort widget in Liferay Portal 7.2.0 through 7.4.3.24, and Liferay DXP 7.2 before fix pack 19, 7.3 before update 5, and DXP 7.4 before update 25 allows remote attackers to inject arbitrary web script or HTML via a crafted payload."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-10-18T00:00:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "http://liferay.com"
},
{
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42112"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2022-42112",
"datePublished": "2022-10-18T00:00:00",
"dateReserved": "2022-10-03T00:00:00",
"dateUpdated": "2024-08-03T13:03:45.719Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2020-15841
Vulnerability from cvelistv5
Published
2020-07-20 01:06
Modified
2024-08-04 13:30
Severity ?
EPSS score ?
Summary
Liferay Portal before 7.3.0, and Liferay DXP 7.0 before fix pack 89, 7.1 before fix pack 17, and 7.2 before fix pack 4, does not safely test a connection to a LDAP server, which allows remote attackers to obtain the LDAP server's password via the Test LDAP Connection feature.
References
| ▼ | URL | Tags |
|---|---|---|
| https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/119317439 | x_refsource_MISC | |
| https://issues.liferay.com/browse/LPE-16928 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T13:30:22.302Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/119317439"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://issues.liferay.com/browse/LPE-16928"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Liferay Portal before 7.3.0, and Liferay DXP 7.0 before fix pack 89, 7.1 before fix pack 17, and 7.2 before fix pack 4, does not safely test a connection to a LDAP server, which allows remote attackers to obtain the LDAP server\u0027s password via the Test LDAP Connection feature."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AC:H/AV:N/A:H/C:H/I:H/PR:N/S:C/UI:R",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-07-20T01:06:39",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/119317439"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://issues.liferay.com/browse/LPE-16928"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2020-15841",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Liferay Portal before 7.3.0, and Liferay DXP 7.0 before fix pack 89, 7.1 before fix pack 17, and 7.2 before fix pack 4, does not safely test a connection to a LDAP server, which allows remote attackers to obtain the LDAP server\u0027s password via the Test LDAP Connection feature."
}
]
},
"impact": {
"cvss": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AC:H/AV:N/A:H/C:H/I:H/PR:N/S:C/UI:R",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/119317439",
"refsource": "MISC",
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/119317439"
},
{
"name": "https://issues.liferay.com/browse/LPE-16928",
"refsource": "MISC",
"url": "https://issues.liferay.com/browse/LPE-16928"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2020-15841",
"datePublished": "2020-07-20T01:06:39",
"dateReserved": "2020-07-20T00:00:00",
"dateUpdated": "2024-08-04T13:30:22.302Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2021-33339
Vulnerability from cvelistv5
Published
2021-08-04 12:48
Modified
2024-08-03 23:50
Severity ?
EPSS score ?
Summary
Cross-site scripting (XSS) vulnerability in the Fragment module in Liferay Portal 7.2.1 through 7.3.4, and Liferay DXP 7.2 before fix pack 9 allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_site_admin_web_portlet_SiteAdminPortlet_name parameter.
References
| ▼ | URL | Tags |
|---|---|---|
| https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120747934 | x_refsource_CONFIRM | |
| https://issues.liferay.com/browse/LPE-17102 | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T23:50:42.489Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120747934"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://issues.liferay.com/browse/LPE-17102"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in the Fragment module in Liferay Portal 7.2.1 through 7.3.4, and Liferay DXP 7.2 before fix pack 9 allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_site_admin_web_portlet_SiteAdminPortlet_name parameter."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-08-04T12:48:21",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120747934"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://issues.liferay.com/browse/LPE-17102"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2021-33339",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in the Fragment module in Liferay Portal 7.2.1 through 7.3.4, and Liferay DXP 7.2 before fix pack 9 allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_site_admin_web_portlet_SiteAdminPortlet_name parameter."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120747934",
"refsource": "CONFIRM",
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120747934"
},
{
"name": "https://issues.liferay.com/browse/LPE-17102",
"refsource": "CONFIRM",
"url": "https://issues.liferay.com/browse/LPE-17102"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2021-33339",
"datePublished": "2021-08-04T12:48:21",
"dateReserved": "2021-05-20T00:00:00",
"dateUpdated": "2024-08-03T23:50:42.489Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2023-44309
Vulnerability from cvelistv5
Published
2023-10-17 08:23
Modified
2024-09-13 16:31
Severity ?
EPSS score ?
Summary
Multiple stored cross-site scripting (XSS) vulnerabilities in the fragment components in Liferay Portal 7.4.2 through 7.4.3.53, and Liferay DXP 7.4 before update 54 allow remote attackers to inject arbitrary web script or HTML via a crafted payload injected into any non-HTML field of a linked source asset.
References
Impacted products
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T19:59:51.992Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-44309"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-44309",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-13T16:31:32.979058Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-13T16:31:44.348Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "DXP",
"vendor": "Liferay",
"versions": [
{
"lessThanOrEqual": "7.4.13.u53",
"status": "affected",
"version": "7.4.13",
"versionType": "maven"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Portal",
"vendor": "Liferay",
"versions": [
{
"lessThanOrEqual": "7.4.3.53",
"status": "affected",
"version": "7.4.2",
"versionType": "maven"
}
]
}
],
"datePublic": "2023-10-17T07:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Multiple stored cross-site scripting (XSS) vulnerabilities in the fragment components in Liferay Portal 7.4.2 through 7.4.3.53, and Liferay DXP 7.4 before update 54 allow remote attackers to inject arbitrary web script or HTML via a crafted payload injected into any non-HTML field of a linked source asset."
}
],
"value": "Multiple stored cross-site scripting (XSS) vulnerabilities in the fragment components in Liferay Portal 7.4.2 through 7.4.3.53, and Liferay DXP 7.4 before update 54 allow remote attackers to inject arbitrary web script or HTML via a crafted payload injected into any non-HTML field of a linked source asset."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-10-17T08:23:27.403Z",
"orgId": "8b54e794-c6f0-462e-9faa-c1001a673ac3",
"shortName": "Liferay"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-44309"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "8b54e794-c6f0-462e-9faa-c1001a673ac3",
"assignerShortName": "Liferay",
"cveId": "CVE-2023-44309",
"datePublished": "2023-10-17T08:23:27.403Z",
"dateReserved": "2023-09-28T11:23:54.829Z",
"dateUpdated": "2024-09-13T16:31:44.348Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2021-33326
Vulnerability from cvelistv5
Published
2021-08-03 18:37
Modified
2024-08-03 23:50
Severity ?
EPSS score ?
Summary
Cross-site scripting (XSS) vulnerability in the Frontend JS module in Liferay Portal 7.3.4 and earlier, and Liferay DXP 7.0 before fix pack 96, 7.1 before fix pack 20 and 7.2 before fix pack 9, allows remote attackers to inject arbitrary web script or HTML via the title of a modal window.
References
| ▼ | URL | Tags |
|---|---|---|
| https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120747869 | x_refsource_CONFIRM | |
| https://issues.liferay.com/browse/LPE-17093 | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T23:50:41.576Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120747869"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://issues.liferay.com/browse/LPE-17093"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in the Frontend JS module in Liferay Portal 7.3.4 and earlier, and Liferay DXP 7.0 before fix pack 96, 7.1 before fix pack 20 and 7.2 before fix pack 9, allows remote attackers to inject arbitrary web script or HTML via the title of a modal window."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-08-03T18:37:32",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120747869"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://issues.liferay.com/browse/LPE-17093"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2021-33326",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in the Frontend JS module in Liferay Portal 7.3.4 and earlier, and Liferay DXP 7.0 before fix pack 96, 7.1 before fix pack 20 and 7.2 before fix pack 9, allows remote attackers to inject arbitrary web script or HTML via the title of a modal window."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120747869",
"refsource": "CONFIRM",
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120747869"
},
{
"name": "https://issues.liferay.com/browse/LPE-17093",
"refsource": "CONFIRM",
"url": "https://issues.liferay.com/browse/LPE-17093"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2021-33326",
"datePublished": "2021-08-03T18:37:32",
"dateReserved": "2021-05-20T00:00:00",
"dateUpdated": "2024-08-03T23:50:41.576Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2022-28979
Vulnerability from cvelistv5
Published
2022-09-21 23:22
Modified
2024-08-03 06:10
Severity ?
EPSS score ?
Summary
Liferay Portal v7.1.0 through v7.4.2 and Liferay DXP 7.1 before fix pack 26, 7.2 before fix pack 15, and 7.3 before service pack 3 was discovered to contain a cross-site scripting (XSS) vulnerability in the Portal Search module's Custom Facet widget. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Custom Parameter Name text field.
References
| ▼ | URL | Tags |
|---|---|---|
| http://liferay.com | x_refsource_MISC | |
| https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-28979-xss-in-custom-facet-widget | x_refsource_MISC | |
| https://issues.liferay.com/browse/LPE-17381 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T06:10:58.713Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://liferay.com"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-28979-xss-in-custom-facet-widget"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://issues.liferay.com/browse/LPE-17381"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Liferay Portal v7.1.0 through v7.4.2 and Liferay DXP 7.1 before fix pack 26, 7.2 before fix pack 15, and 7.3 before service pack 3 was discovered to contain a cross-site scripting (XSS) vulnerability in the Portal Search module\u0027s Custom Facet widget. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Custom Parameter Name text field."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-09-22T23:50:33",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "http://liferay.com"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-28979-xss-in-custom-facet-widget"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://issues.liferay.com/browse/LPE-17381"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2022-28979",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Liferay Portal v7.1.0 through v7.4.2 and Liferay DXP 7.1 before fix pack 26, 7.2 before fix pack 15, and 7.3 before service pack 3 was discovered to contain a cross-site scripting (XSS) vulnerability in the Portal Search module\u0027s Custom Facet widget. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Custom Parameter Name text field."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://liferay.com",
"refsource": "MISC",
"url": "http://liferay.com"
},
{
"name": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-28979-xss-in-custom-facet-widget",
"refsource": "MISC",
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-28979-xss-in-custom-facet-widget"
},
{
"name": "https://issues.liferay.com/browse/LPE-17381",
"refsource": "MISC",
"url": "https://issues.liferay.com/browse/LPE-17381"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2022-28979",
"datePublished": "2022-09-21T23:22:44",
"dateReserved": "2022-04-11T00:00:00",
"dateUpdated": "2024-08-03T06:10:58.713Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2021-33334
Vulnerability from cvelistv5
Published
2021-08-03 20:52
Modified
2024-08-03 23:50
Severity ?
EPSS score ?
Summary
The Dynamic Data Mapping module in Liferay Portal 7.0.0 through 7.3.2, and Liferay DXP 7.0 before fix pack 94, 7.1 before fix pack 19, and 7.2 before fix pack 6, does not properly check user permissions, which allows remote attackers with the forms "Access in Site Administration" permission to view all forms and form entries in a site via the forms section in site administration.
References
| ▼ | URL | Tags |
|---|---|---|
| https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120748332 | x_refsource_CONFIRM | |
| https://issues.liferay.com/browse/LPE-17039 | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T23:50:42.271Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120748332"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://issues.liferay.com/browse/LPE-17039"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The Dynamic Data Mapping module in Liferay Portal 7.0.0 through 7.3.2, and Liferay DXP 7.0 before fix pack 94, 7.1 before fix pack 19, and 7.2 before fix pack 6, does not properly check user permissions, which allows remote attackers with the forms \"Access in Site Administration\" permission to view all forms and form entries in a site via the forms section in site administration."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-08-03T20:52:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120748332"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://issues.liferay.com/browse/LPE-17039"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2021-33334",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The Dynamic Data Mapping module in Liferay Portal 7.0.0 through 7.3.2, and Liferay DXP 7.0 before fix pack 94, 7.1 before fix pack 19, and 7.2 before fix pack 6, does not properly check user permissions, which allows remote attackers with the forms \"Access in Site Administration\" permission to view all forms and form entries in a site via the forms section in site administration."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120748332",
"refsource": "CONFIRM",
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120748332"
},
{
"name": "https://issues.liferay.com/browse/LPE-17039",
"refsource": "CONFIRM",
"url": "https://issues.liferay.com/browse/LPE-17039"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2021-33334",
"datePublished": "2021-08-03T20:52:00",
"dateReserved": "2021-05-20T00:00:00",
"dateUpdated": "2024-08-03T23:50:42.271Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2024-25605
Vulnerability from cvelistv5
Published
2024-02-20 08:51
Modified
2024-08-01 23:44
Severity ?
EPSS score ?
Summary
The Journal module in Liferay Portal 7.2.0 through 7.4.3.4, and older unsupported versions, and Liferay DXP 7.4.13, 7.3 before service pack 3, 7.2 before fix pack 17, and older unsupported versions grants guest users view permission to web content templates by default, which allows remote attackers to view any template via the UI or API.
References
Impacted products
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:liferay:portal:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "portal",
"vendor": "liferay",
"versions": [
{
"lessThanOrEqual": "7.4.3.4",
"status": "affected",
"version": "7.2.0",
"versionType": "maven"
}
]
},
{
"cpes": [
"cpe:2.3:a:liferay:dxp:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "dxp",
"vendor": "liferay",
"versions": [
{
"status": "affected",
"version": "7.4.13"
},
{
"lessThanOrEqual": "7.3.10-dxp-2",
"status": "affected",
"version": "7.3.10",
"versionType": "maven"
},
{
"lessThanOrEqual": "7.2.10 \u003c= 7.2.10-dxp-16",
"status": "affected",
"version": "7.2.10",
"versionType": "maven"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-25605",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-02-20T16:21:08.731302Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-07-29T15:14:35.486Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-01T23:44:09.695Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25605"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Portal",
"vendor": "Liferay",
"versions": [
{
"lessThanOrEqual": "7.4.3.4",
"status": "affected",
"version": "7.2.0",
"versionType": "maven"
}
]
},
{
"defaultStatus": "unknown",
"product": "DXP",
"vendor": "Liferay",
"versions": [
{
"status": "affected",
"version": "7.4.13"
},
{
"lessThanOrEqual": "7.3.10-dxp-2",
"status": "affected",
"version": "7.3.10",
"versionType": "maven"
},
{
"lessThanOrEqual": "7.2.10-dxp-16",
"status": "affected",
"version": "7.2.10",
"versionType": "maven"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The Journal module in Liferay Portal 7.2.0 through 7.4.3.4, and older unsupported versions, and Liferay DXP 7.4.13, 7.3 before service pack 3, 7.2 before fix pack 17, and older unsupported versions grants guest users view permission to web content templates by default, which allows remote attackers to view any template via the UI or API."
}
],
"value": "The Journal module in Liferay Portal 7.2.0 through 7.4.3.4, and older unsupported versions, and Liferay DXP 7.4.13, 7.3 before service pack 3, 7.2 before fix pack 17, and older unsupported versions grants guest users view permission to web content templates by default, which allows remote attackers to view any template via the UI or API."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-276",
"description": "CWE-276 Incorrect Default Permissions",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-02-20T08:51:32.953Z",
"orgId": "8b54e794-c6f0-462e-9faa-c1001a673ac3",
"shortName": "Liferay"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25605"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "8b54e794-c6f0-462e-9faa-c1001a673ac3",
"assignerShortName": "Liferay",
"cveId": "CVE-2024-25605",
"datePublished": "2024-02-20T08:51:32.953Z",
"dateReserved": "2024-02-08T13:57:11.425Z",
"dateUpdated": "2024-08-01T23:44:09.695Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2023-33945
Vulnerability from cvelistv5
Published
2023-05-24 15:22
Modified
2024-10-22 15:51
Severity ?
EPSS score ?
Summary
SQL injection vulnerability in the upgrade process for SQL Server in Liferay Portal 7.3.1 through 7.4.3.17, and Liferay DXP 7.3 before update 6, and 7.4 before update 18 allows attackers to execute arbitrary SQL commands via the name of a database table's primary key index. This vulnerability is only exploitable when chained with other attacks. To exploit this vulnerability, the attacker must modify the database and wait for the application to be upgraded.
References
Impacted products
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T15:54:13.406Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-33945"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-33945",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-10-22T15:49:11.404495Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-10-22T15:51:59.026Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Portal",
"vendor": "Liferay",
"versions": [
{
"lessThanOrEqual": "7.4.3.17",
"status": "affected",
"version": "7.3.1",
"versionType": "maven"
}
]
},
{
"defaultStatus": "unaffected",
"product": "DXP",
"vendor": "Liferay",
"versions": [
{
"lessThanOrEqual": "7.3.10.u5",
"status": "affected",
"version": "7.3.10",
"versionType": "maven"
},
{
"lessThanOrEqual": "7.4.13.u17",
"status": "affected",
"version": "7.4.13",
"versionType": "maven"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "SQL injection vulnerability in the upgrade process for SQL Server in Liferay Portal 7.3.1 through 7.4.3.17, and Liferay DXP 7.3 before update 6, and 7.4 before update 18 allows attackers to execute arbitrary SQL commands via the name of a database table\u0027s primary key index. This vulnerability is only exploitable when chained with other attacks. To exploit this vulnerability, the attacker must modify the database and wait for the application to be upgraded."
}
],
"value": "SQL injection vulnerability in the upgrade process for SQL Server in Liferay Portal 7.3.1 through 7.4.3.17, and Liferay DXP 7.3 before update 6, and 7.4 before update 18 allows attackers to execute arbitrary SQL commands via the name of a database table\u0027s primary key index. This vulnerability is only exploitable when chained with other attacks. To exploit this vulnerability, the attacker must modify the database and wait for the application to be upgraded."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-05-24T15:22:39.081Z",
"orgId": "8b54e794-c6f0-462e-9faa-c1001a673ac3",
"shortName": "Liferay"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-33945"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "8b54e794-c6f0-462e-9faa-c1001a673ac3",
"assignerShortName": "Liferay",
"cveId": "CVE-2023-33945",
"datePublished": "2023-05-24T15:22:39.081Z",
"dateReserved": "2023-05-24T02:36:00.164Z",
"dateUpdated": "2024-10-22T15:51:59.026Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2023-33946
Vulnerability from cvelistv5
Published
2023-05-24 15:28
Modified
2024-10-22 15:51
Severity ?
EPSS score ?
Summary
The Object module in Liferay Portal 7.4.3.4 through 7.4.3.48, and Liferay DXP 7.4 before update 49 does properly isolate objects in difference virtual instances, which allows remote authenticated users in one virtual instance to view objects in a different virtual instance via OAuth 2 scope administration page.
References
Impacted products
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T15:54:13.397Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-33946"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-33946",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-10-22T15:44:36.680172Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-10-22T15:51:52.390Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Portal",
"vendor": "Liferay",
"versions": [
{
"lessThanOrEqual": "7.4.3.48",
"status": "affected",
"version": "7.4.3.4",
"versionType": "maven"
}
]
},
{
"defaultStatus": "unaffected",
"product": "DXP",
"vendor": "Liferay",
"versions": [
{
"lessThanOrEqual": "7.4.13.u48",
"status": "affected",
"version": "7.4.13",
"versionType": "maven"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The Object module in Liferay Portal 7.4.3.4 through 7.4.3.48, and Liferay DXP 7.4 before update 49 does properly isolate objects in difference virtual instances, which allows remote authenticated users in one virtual instance to view objects in a different virtual instance via OAuth 2 scope administration page."
}
],
"value": "The Object module in Liferay Portal 7.4.3.4 through 7.4.3.48, and Liferay DXP 7.4 before update 49 does properly isolate objects in difference virtual instances, which allows remote authenticated users in one virtual instance to view objects in a different virtual instance via OAuth 2 scope administration page."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 2.7,
"baseSeverity": "LOW",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "CWE-284 Improper Access Control",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-05-24T15:28:28.713Z",
"orgId": "8b54e794-c6f0-462e-9faa-c1001a673ac3",
"shortName": "Liferay"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-33946"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "8b54e794-c6f0-462e-9faa-c1001a673ac3",
"assignerShortName": "Liferay",
"cveId": "CVE-2023-33946",
"datePublished": "2023-05-24T15:28:28.713Z",
"dateReserved": "2023-05-24T02:36:00.165Z",
"dateUpdated": "2024-10-22T15:51:52.390Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2024-26270
Vulnerability from cvelistv5
Published
2024-02-20 13:43
Modified
2024-08-16 19:55
Severity ?
EPSS score ?
Summary
The Account Settings page in Liferay Portal 7.4.3.76 through 7.4.3.99, and Liferay DXP 2023.Q3 before patch 5, and 7.4 update 76 through 92 embeds the user’s hashed password in the page’s HTML source, which allows man-in-the-middle attackers to steal a user's hashed password.
References
Impacted products
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T00:07:19.056Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-26270"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-26270",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-08-16T19:55:04.883437Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-08-16T19:55:12.801Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Portal",
"vendor": "Liferay",
"versions": [
{
"lessThanOrEqual": "7.4.3.99",
"status": "affected",
"version": "7.4.3.76",
"versionType": "maven"
}
]
},
{
"defaultStatus": "unaffected",
"product": "DXP",
"vendor": "Liferay",
"versions": [
{
"lessThanOrEqual": "2023.q3.4",
"status": "affected",
"version": "2023.q3.1",
"versionType": "maven"
},
{
"lessThanOrEqual": "7.4.13.u92",
"status": "affected",
"version": "7.4.13.u76",
"versionType": "maven"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The Account Settings page in Liferay Portal 7.4.3.76 through 7.4.3.99, and Liferay DXP 2023.Q3 before patch 5, and 7.4 update 76 through 92 embeds the user\u2019s hashed password in the page\u2019s HTML source, which allows man-in-the-middle attackers to steal a user\u0027s hashed password."
}
],
"value": "The Account Settings page in Liferay Portal 7.4.3.76 through 7.4.3.99, and Liferay DXP 2023.Q3 before patch 5, and 7.4 update 76 through 92 embeds the user\u2019s hashed password in the page\u2019s HTML source, which allows man-in-the-middle attackers to steal a user\u0027s hashed password."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-201",
"description": "CWE-201 Insertion of Sensitive Information Into Sent Data",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-02-20T13:43:46.074Z",
"orgId": "8b54e794-c6f0-462e-9faa-c1001a673ac3",
"shortName": "Liferay"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-26270"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "8b54e794-c6f0-462e-9faa-c1001a673ac3",
"assignerShortName": "Liferay",
"cveId": "CVE-2024-26270",
"datePublished": "2024-02-20T13:43:46.074Z",
"dateReserved": "2024-02-15T07:44:36.776Z",
"dateUpdated": "2024-08-16T19:55:12.801Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2022-38512
Vulnerability from cvelistv5
Published
2022-09-22 00:17
Modified
2024-08-03 10:54
Severity ?
EPSS score ?
Summary
The Translation module in Liferay Portal v7.4.3.12 through v7.4.3.36, and Liferay DXP 7.4 update 8 through 36 does not check permissions before allowing a user to export a web content for translation, allowing attackers to download a web content page's XLIFF translation file via crafted URL.
References
| ▼ | URL | Tags |
|---|---|---|
| http://liferay.com | x_refsource_MISC | |
| https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-38512 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T10:54:03.585Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://liferay.com"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-38512"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The Translation module in Liferay Portal v7.4.3.12 through v7.4.3.36, and Liferay DXP 7.4 update 8 through 36 does not check permissions before allowing a user to export a web content for translation, allowing attackers to download a web content page\u0027s XLIFF translation file via crafted URL."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-09-22T00:17:41",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "http://liferay.com"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-38512"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2022-38512",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The Translation module in Liferay Portal v7.4.3.12 through v7.4.3.36, and Liferay DXP 7.4 update 8 through 36 does not check permissions before allowing a user to export a web content for translation, allowing attackers to download a web content page\u0027s XLIFF translation file via crafted URL."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://liferay.com",
"refsource": "MISC",
"url": "http://liferay.com"
},
{
"name": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-38512",
"refsource": "MISC",
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-38512"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2022-38512",
"datePublished": "2022-09-22T00:17:41",
"dateReserved": "2022-08-22T00:00:00",
"dateUpdated": "2024-08-03T10:54:03.585Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2023-33937
Vulnerability from cvelistv5
Published
2023-05-24 12:16
Modified
2024-10-22 15:52
Severity ?
EPSS score ?
Summary
Stored cross-site scripting (XSS) vulnerability in Form widget configuration in Liferay Portal 7.1.0 through 7.3.0, and Liferay DXP 7.1 before fix pack 18, and 7.2 before fix pack 5 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a form's `name` field.
References
Impacted products
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T15:54:13.972Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-33937"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-33937",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-10-22T15:46:27.983047Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-10-22T15:52:55.857Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Portal",
"vendor": "Liferay",
"versions": [
{
"lessThanOrEqual": "7.3.0",
"status": "affected",
"version": "7.1.0",
"versionType": "maven"
}
]
},
{
"defaultStatus": "unaffected",
"product": "DXP",
"vendor": "Liferay",
"versions": [
{
"lessThanOrEqual": "7.1.10-dxp-17",
"status": "affected",
"version": "7.1.10",
"versionType": "maven"
},
{
"lessThanOrEqual": "7.2.10-dxp-4",
"status": "affected",
"version": "7.2.10",
"versionType": "maven"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Stored cross-site scripting (XSS) vulnerability in Form widget configuration in Liferay Portal 7.1.0 through 7.3.0, and Liferay DXP 7.1 before fix pack 18, and 7.2 before fix pack 5 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a form\u0027s `name` field."
}
],
"value": "Stored cross-site scripting (XSS) vulnerability in Form widget configuration in Liferay Portal 7.1.0 through 7.3.0, and Liferay DXP 7.1 before fix pack 18, and 7.2 before fix pack 5 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a form\u0027s `name` field."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-05-24T12:16:36.342Z",
"orgId": "8b54e794-c6f0-462e-9faa-c1001a673ac3",
"shortName": "Liferay"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-33937"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "8b54e794-c6f0-462e-9faa-c1001a673ac3",
"assignerShortName": "Liferay",
"cveId": "CVE-2023-33937",
"datePublished": "2023-05-24T12:16:36.342Z",
"dateReserved": "2023-05-24T02:36:00.162Z",
"dateUpdated": "2024-10-22T15:52:55.857Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2023-42629
Vulnerability from cvelistv5
Published
2023-10-17 08:13
Modified
2024-08-02 19:23
Severity ?
EPSS score ?
Summary
Stored cross-site scripting (XSS) vulnerability in the manage vocabulary page in Liferay Portal 7.4.2 through 7.4.3.87, and Liferay DXP 7.4 before update 88 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a Vocabulary's 'description' text field.
References
| ▼ | URL | Tags |
|---|---|---|
| https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-42629 | vendor-advisory | |
| https://www.pentagrid.ch/en/blog/stored-cross-site-scripting-vulnerabilities-in-liferay-portal/ | exploit, third-party-advisory |
Impacted products
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T19:23:40.057Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-42629"
},
{
"tags": [
"exploit",
"third-party-advisory",
"x_transferred"
],
"url": "https://www.pentagrid.ch/en/blog/stored-cross-site-scripting-vulnerabilities-in-liferay-portal/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "DXP",
"vendor": "Liferay",
"versions": [
{
"lessThanOrEqual": "7.4.13.u87",
"status": "affected",
"version": "7.4.13",
"versionType": "maven"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Portal",
"vendor": "Liferay",
"versions": [
{
"lessThanOrEqual": "7.4.3.87",
"status": "affected",
"version": "7.4.2",
"versionType": "maven"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"user": "00000000-0000-4000-9000-000000000000",
"value": "Michael Oelke"
}
],
"datePublic": "2023-10-17T07:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Stored cross-site scripting (XSS) vulnerability in the manage vocabulary page in Liferay Portal 7.4.2 through 7.4.3.87, and Liferay DXP 7.4 before update 88 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a Vocabulary\u0027s \u0027description\u0027 text field."
}
],
"value": "Stored cross-site scripting (XSS) vulnerability in the manage vocabulary page in Liferay Portal 7.4.2 through 7.4.3.87, and Liferay DXP 7.4 before update 88 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a Vocabulary\u0027s \u0027description\u0027 text field."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-11-10T02:34:30.191Z",
"orgId": "8b54e794-c6f0-462e-9faa-c1001a673ac3",
"shortName": "Liferay"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-42629"
},
{
"tags": [
"exploit",
"third-party-advisory"
],
"url": "https://www.pentagrid.ch/en/blog/stored-cross-site-scripting-vulnerabilities-in-liferay-portal/"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "8b54e794-c6f0-462e-9faa-c1001a673ac3",
"assignerShortName": "Liferay",
"cveId": "CVE-2023-42629",
"datePublished": "2023-10-17T08:13:31.830Z",
"dateReserved": "2023-09-12T05:35:42.826Z",
"dateUpdated": "2024-08-02T19:23:40.057Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2024-25607
Vulnerability from cvelistv5
Published
2024-02-20 09:17
Modified
2024-08-01 23:44
Severity ?
EPSS score ?
Summary
The default password hashing algorithm (PBKDF2-HMAC-SHA1) in Liferay Portal 7.2.0 through 7.4.3.15, and older unsupported versions, and Liferay DXP 7.4 before update 16, 7.3 before update 4, 7.2 before fix pack 17, and older unsupported versions defaults to a low work factor, which allows attackers to quickly crack password hashes.
References
Impacted products
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:liferay:digital_experience_platform:7.2.10:*:*:*:*:*:*:*",
"cpe:2.3:a:liferay:digital_experience_platform:7.3.10:*:*:*:*:*:*:*",
"cpe:2.3:a:liferay:digital_experience_platform:7.4.13:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "digital_experience_platform",
"vendor": "liferay",
"versions": [
{
"lessThanOrEqual": "7.2.10-dxp-16",
"status": "affected",
"version": "7.2.10",
"versionType": "custom"
},
{
"lessThanOrEqual": "7.3.10-dxp-3",
"status": "affected",
"version": "7.3.10",
"versionType": "custom"
},
{
"lessThanOrEqual": "7.4.13.u15",
"status": "affected",
"version": "7.4.13",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:liferay:liferay_portal:7.2.0:*:*:*:*:*:*:*",
"cpe:2.3:a:liferay:liferay_portal:7.3.0:*:*:*:*:*:*:*",
"cpe:2.3:a:liferay:liferay_portal:7.4.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "liferay_portal",
"vendor": "liferay",
"versions": [
{
"lessThanOrEqual": "7.2.1",
"status": "affected",
"version": "7.2.0",
"versionType": "custom"
},
{
"lessThanOrEqual": "7.3.7",
"status": "affected",
"version": "7.3.0",
"versionType": "custom"
},
{
"lessThanOrEqual": "7.4.3.13",
"status": "affected",
"version": "7.4.0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-25607",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-02-20T13:27:04.966342Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-07-26T19:15:32.185Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-01T23:44:09.762Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25607"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Portal",
"vendor": "Liferay",
"versions": [
{
"lessThanOrEqual": "7.4.3.15",
"status": "affected",
"version": "7.2.0",
"versionType": "maven"
}
]
},
{
"defaultStatus": "unknown",
"product": "DXP",
"vendor": "Liferay",
"versions": [
{
"lessThanOrEqual": "7.4.13.u15",
"status": "affected",
"version": "7.4.13",
"versionType": "maven"
},
{
"lessThanOrEqual": "7.3.10-dxp-3",
"status": "affected",
"version": "7.3.10",
"versionType": "maven"
},
{
"lessThanOrEqual": "7.2.10-dxp-16",
"status": "affected",
"version": "7.2.10",
"versionType": "maven"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The default password hashing algorithm (PBKDF2-HMAC-SHA1) in Liferay Portal 7.2.0 through 7.4.3.15, and older unsupported versions, and Liferay DXP 7.4 before update 16, 7.3 before update 4, 7.2 before fix pack 17, and older unsupported versions defaults to a low work factor, which allows attackers to quickly crack password hashes."
}
],
"value": "The default password hashing algorithm (PBKDF2-HMAC-SHA1) in Liferay Portal 7.2.0 through 7.4.3.15, and older unsupported versions, and Liferay DXP 7.4 before update 16, 7.3 before update 4, 7.2 before fix pack 17, and older unsupported versions defaults to a low work factor, which allows attackers to quickly crack password hashes."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-916",
"description": "CWE-916 Use of Password Hash With Insufficient Computational Effort",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-02-20T09:17:04.894Z",
"orgId": "8b54e794-c6f0-462e-9faa-c1001a673ac3",
"shortName": "Liferay"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25607"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "8b54e794-c6f0-462e-9faa-c1001a673ac3",
"assignerShortName": "Liferay",
"cveId": "CVE-2024-25607",
"datePublished": "2024-02-20T09:17:04.894Z",
"dateReserved": "2024-02-08T13:57:11.425Z",
"dateUpdated": "2024-08-01T23:44:09.762Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2021-33337
Vulnerability from cvelistv5
Published
2021-08-04 13:15
Modified
2024-08-03 23:50
Severity ?
EPSS score ?
Summary
Cross-site scripting (XSS) vulnerability in the Document Library module's add document menu in Liferay Portal 7.3.0 through 7.3.4, and Liferay DXP 7.1 before fix pack 20, and 7.2 before fix pack 9, allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_document_library_web_portlet_DLAdminPortlet_name parameter.
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T23:50:42.548Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2021-33337-stored-xss-with-document-types-in-documents-and-media"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://issues.liferay.com/browse/LPE-17101"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in the Document Library module\u0027s add document menu in Liferay Portal 7.3.0 through 7.3.4, and Liferay DXP 7.1 before fix pack 20, and 7.2 before fix pack 9, allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_document_library_web_portlet_DLAdminPortlet_name parameter."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-08-04T13:15:07",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2021-33337-stored-xss-with-document-types-in-documents-and-media"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://issues.liferay.com/browse/LPE-17101"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2021-33337",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in the Document Library module\u0027s add document menu in Liferay Portal 7.3.0 through 7.3.4, and Liferay DXP 7.1 before fix pack 20, and 7.2 before fix pack 9, allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_document_library_web_portlet_DLAdminPortlet_name parameter."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2021-33337-stored-xss-with-document-types-in-documents-and-media",
"refsource": "CONFIRM",
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2021-33337-stored-xss-with-document-types-in-documents-and-media"
},
{
"name": "https://issues.liferay.com/browse/LPE-17101",
"refsource": "CONFIRM",
"url": "https://issues.liferay.com/browse/LPE-17101"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2021-33337",
"datePublished": "2021-08-04T13:15:07",
"dateReserved": "2021-05-20T00:00:00",
"dateUpdated": "2024-08-03T23:50:42.548Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2023-33943
Vulnerability from cvelistv5
Published
2023-05-24 14:57
Modified
2024-10-22 15:52
Severity ?
EPSS score ?
Summary
Cross-site scripting (XSS) vulnerability in the Account module in Liferay Portal 7.4.3.21 through 7.4.3.62, and Liferay DXP 7.4 update 21 through 62 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a user's (1) First Name, (2) Middle Name, (3) Last Name, or (4) Job Title text field.
References
Impacted products
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T15:54:13.419Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-33943"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-33943",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-10-22T15:46:56.420516Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-10-22T15:52:13.867Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Portal",
"vendor": "Liferay",
"versions": [
{
"lessThanOrEqual": "7.4.3.62",
"status": "affected",
"version": "7.4.3.21",
"versionType": "maven"
}
]
},
{
"defaultStatus": "unaffected",
"product": "DXP",
"vendor": "Liferay",
"versions": [
{
"lessThanOrEqual": "7.4.13.u62",
"status": "affected",
"version": "7.4.13.u21",
"versionType": "maven"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Cross-site scripting (XSS) vulnerability in the Account module in Liferay Portal 7.4.3.21 through 7.4.3.62, and Liferay DXP 7.4 update 21 through 62 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a user\u0027s (1) First Name, (2) Middle Name, (3) Last Name, or (4) Job Title text field."
}
],
"value": "Cross-site scripting (XSS) vulnerability in the Account module in Liferay Portal 7.4.3.21 through 7.4.3.62, and Liferay DXP 7.4 update 21 through 62 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a user\u0027s (1) First Name, (2) Middle Name, (3) Last Name, or (4) Job Title text field."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-05-24T14:57:46.177Z",
"orgId": "8b54e794-c6f0-462e-9faa-c1001a673ac3",
"shortName": "Liferay"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-33943"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "8b54e794-c6f0-462e-9faa-c1001a673ac3",
"assignerShortName": "Liferay",
"cveId": "CVE-2023-33943",
"datePublished": "2023-05-24T14:57:46.177Z",
"dateReserved": "2023-05-24T02:36:00.163Z",
"dateUpdated": "2024-10-22T15:52:13.867Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2021-29052
Vulnerability from cvelistv5
Published
2021-05-17 11:16
Modified
2024-08-03 21:55
Severity ?
EPSS score ?
Summary
The Data Engine module in Liferay Portal 7.3.0 through 7.3.5, and Liferay DXP 7.3 before fix pack 1 does not check permissions in DataDefinitionResourceImpl.getSiteDataDefinitionByContentTypeByDataDefinitionKey, which allows remote authenticated users to view DDMStructures via GET API calls.
References
| ▼ | URL | Tags |
|---|---|---|
| http://liferay.com | x_refsource_MISC | |
| https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120743159 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T21:55:12.481Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://liferay.com"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120743159"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The Data Engine module in Liferay Portal 7.3.0 through 7.3.5, and Liferay DXP 7.3 before fix pack 1 does not check permissions in DataDefinitionResourceImpl.getSiteDataDefinitionByContentTypeByDataDefinitionKey, which allows remote authenticated users to view DDMStructures via GET API calls."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-05-17T11:16:27",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "http://liferay.com"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120743159"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2021-29052",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The Data Engine module in Liferay Portal 7.3.0 through 7.3.5, and Liferay DXP 7.3 before fix pack 1 does not check permissions in DataDefinitionResourceImpl.getSiteDataDefinitionByContentTypeByDataDefinitionKey, which allows remote authenticated users to view DDMStructures via GET API calls."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://liferay.com",
"refsource": "MISC",
"url": "http://liferay.com"
},
{
"name": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120743159",
"refsource": "MISC",
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120743159"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2021-29052",
"datePublished": "2021-05-17T11:16:27",
"dateReserved": "2021-03-22T00:00:00",
"dateUpdated": "2024-08-03T21:55:12.481Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2021-29053
Vulnerability from cvelistv5
Published
2021-05-17 10:41
Modified
2024-08-03 21:55
Severity ?
EPSS score ?
Summary
Multiple SQL injection vulnerabilities in Liferay Portal 7.3.5 and Liferay DXP 7.3 before fix pack 1 allow remote authenticated users to execute arbitrary SQL commands via the classPKField parameter to (1) CommerceChannelRelFinder.countByC_C, or (2) CommerceChannelRelFinder.findByC_C.
References
| ▼ | URL | Tags |
|---|---|---|
| http://liferay.com | x_refsource_MISC | |
| https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120778225 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T21:55:12.512Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://liferay.com"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120778225"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Multiple SQL injection vulnerabilities in Liferay Portal 7.3.5 and Liferay DXP 7.3 before fix pack 1 allow remote authenticated users to execute arbitrary SQL commands via the classPKField parameter to (1) CommerceChannelRelFinder.countByC_C, or (2) CommerceChannelRelFinder.findByC_C."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-05-17T10:41:13",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "http://liferay.com"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120778225"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2021-29053",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Multiple SQL injection vulnerabilities in Liferay Portal 7.3.5 and Liferay DXP 7.3 before fix pack 1 allow remote authenticated users to execute arbitrary SQL commands via the classPKField parameter to (1) CommerceChannelRelFinder.countByC_C, or (2) CommerceChannelRelFinder.findByC_C."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://liferay.com",
"refsource": "MISC",
"url": "http://liferay.com"
},
{
"name": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120778225",
"refsource": "MISC",
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120778225"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2021-29053",
"datePublished": "2021-05-17T10:41:13",
"dateReserved": "2021-03-22T00:00:00",
"dateUpdated": "2024-08-03T21:55:12.512Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2021-33322
Vulnerability from cvelistv5
Published
2021-08-03 18:29
Modified
2024-08-03 23:50
Severity ?
EPSS score ?
Summary
In Liferay Portal 7.3.0 and earlier, and Liferay DXP 7.0 before fix pack 96, 7.1 before fix pack 18, and 7.2 before fix pack 5, password reset tokens are not invalidated after a user changes their password, which allows remote attackers to change the user’s password via the old password reset token.
References
| ▼ | URL | Tags |
|---|---|---|
| https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120748020 | x_refsource_CONFIRM | |
| https://issues.liferay.com/browse/LPE-16981 | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T23:50:42.319Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120748020"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://issues.liferay.com/browse/LPE-16981"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In Liferay Portal 7.3.0 and earlier, and Liferay DXP 7.0 before fix pack 96, 7.1 before fix pack 18, and 7.2 before fix pack 5, password reset tokens are not invalidated after a user changes their password, which allows remote attackers to change the user\u2019s password via the old password reset token."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-08-03T18:29:17",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120748020"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://issues.liferay.com/browse/LPE-16981"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2021-33322",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "In Liferay Portal 7.3.0 and earlier, and Liferay DXP 7.0 before fix pack 96, 7.1 before fix pack 18, and 7.2 before fix pack 5, password reset tokens are not invalidated after a user changes their password, which allows remote attackers to change the user\u2019s password via the old password reset token."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120748020",
"refsource": "CONFIRM",
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120748020"
},
{
"name": "https://issues.liferay.com/browse/LPE-16981",
"refsource": "CONFIRM",
"url": "https://issues.liferay.com/browse/LPE-16981"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2021-33322",
"datePublished": "2021-08-03T18:29:17",
"dateReserved": "2021-05-20T00:00:00",
"dateUpdated": "2024-08-03T23:50:42.319Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
Vulnerability from fkie_nvd
Published
2021-08-03 19:15
Modified
2024-11-21 06:08
Severity ?
Summary
The Flags module in Liferay Portal 7.3.1 and earlier, and Liferay DXP 7.0 before fix pack 96, 7.1 before fix pack 20, and 7.2 before fix pack 5, does not limit the rate at which content can be flagged as inappropriate, which allows remote authenticated users to spam the site administrator with emails
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | https://issues.liferay.com/browse/LPE-17007 | Patch, Vendor Advisory | |
| cve@mitre.org | https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120747590 | Patch, Release Notes, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://issues.liferay.com/browse/LPE-17007 | Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120747590 | Patch, Release Notes, Vendor Advisory |
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:-:*:*:*:*:*:*",
"matchCriteriaId": "43A92274-7D88-4F0F-8265-CF862011F27F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_13:*:*:*:*:*:*",
"matchCriteriaId": "4874012D-52AA-4C32-95E9-BD331225B4E6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_14:*:*:*:*:*:*",
"matchCriteriaId": "21CAF86F-CEC9-44EE-BAF8-0F7AF9D945F5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_24:*:*:*:*:*:*",
"matchCriteriaId": "EF6C9F29-EEFF-4737-BD50-58572D6C14E9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_25:*:*:*:*:*:*",
"matchCriteriaId": "D24E1FA0-BD94-4AFC-92BF-AEDEBC7DCF4B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_26:*:*:*:*:*:*",
"matchCriteriaId": "FF9B54EE-973B-44B4-8EA2-B58FA49AC561",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_27:*:*:*:*:*:*",
"matchCriteriaId": "A9637223-557D-474B-A46B-D276866376C3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_28:*:*:*:*:*:*",
"matchCriteriaId": "F6306F9C-99DE-4F94-8E7F-6747762BEC45",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_3\\+:*:*:*:*:*:*",
"matchCriteriaId": "2DFF08F0-77C1-43A0-B7DD-9B905BE074EB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_30:*:*:*:*:*:*",
"matchCriteriaId": "48B7015C-26B9-453E-B3CF-9B220D3A8024",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_33:*:*:*:*:*:*",
"matchCriteriaId": "0FEB6921-3C45-4B7E-8B34-CDC34984583D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_35:*:*:*:*:*:*",
"matchCriteriaId": "525F45DC-2E5C-46A8-AEDF-9D6B8FA2EB11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_36:*:*:*:*:*:*",
"matchCriteriaId": "55755D0C-4C0C-42D9-BE5E-5D33C8BA4C7F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_39:*:*:*:*:*:*",
"matchCriteriaId": "FB4FE0F9-EB19-45D7-A953-674629D951F5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_40:*:*:*:*:*:*",
"matchCriteriaId": "22E4B63F-01A9-4F85-92BC-A51F41BE4121",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_41:*:*:*:*:*:*",
"matchCriteriaId": "23BE441D-8770-4F4D-86CD-4E53161F54FB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_42:*:*:*:*:*:*",
"matchCriteriaId": "E14FF010-3907-4C79-B945-C792E446CB31",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_43:*:*:*:*:*:*",
"matchCriteriaId": "B97B5817-B55E-485D-9747-3A50CF7245C8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_44:*:*:*:*:*:*",
"matchCriteriaId": "19EBD671-56BD-45D3-9248-DAF3F47B36FD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_45:*:*:*:*:*:*",
"matchCriteriaId": "93EDC2A1-9622-44DB-ABA8-754D61B60787",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_46:*:*:*:*:*:*",
"matchCriteriaId": "B4B6A06D-C323-431C-9A65-4FD6A6E4CAB6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_47:*:*:*:*:*:*",
"matchCriteriaId": "EE6D4466-1C3A-4D5A-A65C-A30A87EADF1A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_48:*:*:*:*:*:*",
"matchCriteriaId": "4F0BC40A-8E13-4665-A2E4-F5815CA70E17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_49:*:*:*:*:*:*",
"matchCriteriaId": "11FB69C3-7755-495A-AB76-201AF4D9623B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_50:*:*:*:*:*:*",
"matchCriteriaId": "FF66F652-6C08-4D47-865D-36E70360B632",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_51:*:*:*:*:*:*",
"matchCriteriaId": "17B68D59-0509-4C6A-B803-03A02EB76F1F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_52:*:*:*:*:*:*",
"matchCriteriaId": "8F69B287-3B86-4B64-BCB4-40E9495A628D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_53:*:*:*:*:*:*",
"matchCriteriaId": "C627090E-A1BF-4332-9538-EE4E184DB65E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_54:*:*:*:*:*:*",
"matchCriteriaId": "9A089471-9944-4C75-A25F-1F23C18C0CF0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_56:*:*:*:*:*:*",
"matchCriteriaId": "B90E7FBF-6B5B-457A-8B20-ECA69A626BB8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_57:*:*:*:*:*:*",
"matchCriteriaId": "1975C1AB-EF50-42E2-9879-17FB763B45F9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_58:*:*:*:*:*:*",
"matchCriteriaId": "DFB7BB13-773B-47A6-A001-B9EBA46C917E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_59:*:*:*:*:*:*",
"matchCriteriaId": "1C4A2D39-3725-4E80-9F3F-AC1F4EE662E8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_60:*:*:*:*:*:*",
"matchCriteriaId": "BAEDF88B-B9C8-4891-B199-A72C066FC7BF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_61:*:*:*:*:*:*",
"matchCriteriaId": "F768E1DD-3DC6-4783-82DE-D089C7CD3C63",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_64:*:*:*:*:*:*",
"matchCriteriaId": "426EDA92-FE5A-4523-8AAE-1E5D5D67F535",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_65:*:*:*:*:*:*",
"matchCriteriaId": "070CB609-6D4B-4817-9F91-00BD62423E56",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_66:*:*:*:*:*:*",
"matchCriteriaId": "FEE87846-A4CF-47E5-93AA-5D7E2548D28D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_67:*:*:*:*:*:*",
"matchCriteriaId": "A4C11B0E-6D94-4A65-83BE-1E5828710CB9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_68:*:*:*:*:*:*",
"matchCriteriaId": "F1DC73B1-4017-424F-A28D-F54F2FA8ED8C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_69:*:*:*:*:*:*",
"matchCriteriaId": "32B4FD3C-7BB7-4DA2-9A3A-05A6370B9745",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_70:*:*:*:*:*:*",
"matchCriteriaId": "71293E5B-4DCC-47BC-A493-3540D57E6067",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_71:*:*:*:*:*:*",
"matchCriteriaId": "56A8940B-318E-4C6A-9131-A50E90E82C28",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_72:*:*:*:*:*:*",
"matchCriteriaId": "F09B5E82-DC18-4B07-9A05-E433579B4FB5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_73:*:*:*:*:*:*",
"matchCriteriaId": "CE25D189-2D6F-4229-BF09-2CEA0A6C5D50",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_75:*:*:*:*:*:*",
"matchCriteriaId": "36549BE5-DEDB-408A-BFC9-AB00031D45DD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_76:*:*:*:*:*:*",
"matchCriteriaId": "E11B8075-4212-41CB-85AC-09FA1CDB86A1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_78:*:*:*:*:*:*",
"matchCriteriaId": "80412DCE-D79F-492A-8788-6A43C4D76D7C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_79:*:*:*:*:*:*",
"matchCriteriaId": "BC7A939F-21D1-4AF1-BAB9-E91DFCFFB7A2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_80:*:*:*:*:*:*",
"matchCriteriaId": "5F2240FC-EDDC-47F5-B713-07FF2D23CE00",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_81:*:*:*:*:*:*",
"matchCriteriaId": "5006AAE4-B154-468A-850C-20171965E2AC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_82:*:*:*:*:*:*",
"matchCriteriaId": "1541072D-3F14-47A2-8A42-EF2765643AE4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_83:*:*:*:*:*:*",
"matchCriteriaId": "2340C85F-0296-4591-8D23-56634C50C5F8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_84:*:*:*:*:*:*",
"matchCriteriaId": "6BEC3C5C-DA8C-4620-A38E-BB47D4CB7CBA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_85:*:*:*:*:*:*",
"matchCriteriaId": "6DD38B1F-7EEA-4DB5-A31B-D84DC33313FA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_86:*:*:*:*:*:*",
"matchCriteriaId": "FC923A9E-CF9D-44DE-AB58-7BCAAFDDE7D6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_87:*:*:*:*:*:*",
"matchCriteriaId": "65542031-04E1-485F-8102-04CB65865ECE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_88:*:*:*:*:*:*",
"matchCriteriaId": "B36F2FBD-E949-4608-9ECF-0F05DD8E487E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_89:*:*:*:*:*:*",
"matchCriteriaId": "D68832F1-6D71-4A63-AA8A-86C0EDF9F8E1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_90:*:*:*:*:*:*",
"matchCriteriaId": "FD1F579A-084C-46A9-ADCA-8F3FA45D85D6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_91:*:*:*:*:*:*",
"matchCriteriaId": "FC81C494-F68E-4580-87FB-7792C1080DFC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_92:*:*:*:*:*:*",
"matchCriteriaId": "6693594D-6731-4223-8C28-4873746B97AB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_93:*:*:*:*:*:*",
"matchCriteriaId": "0B96CDC5-F4DE-49A2-B09D-318163EC9A09",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_94:*:*:*:*:*:*",
"matchCriteriaId": "EEAE13AF-DEEE-4284-A93D-EFE2647E12FB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_95:*:*:*:*:*:*",
"matchCriteriaId": "9EEADDC3-C436-452F-9271-8F30A9D03FE6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:-:*:*:*:*:*:*",
"matchCriteriaId": "C2AA7E18-A41B-4F0D-A04F-57C5745D091B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_1:*:*:*:*:*:*",
"matchCriteriaId": "392B783D-620D-4C71-AAA0-848B16964A27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_10:*:*:*:*:*:*",
"matchCriteriaId": "4F5A94E2-22B7-4D2D-A491-29F395E727C5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_11:*:*:*:*:*:*",
"matchCriteriaId": "E9B10908-C42B-4763-9D47-236506B0E84A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_12:*:*:*:*:*:*",
"matchCriteriaId": "CF544435-36AC-49B8-BA50-A6B6D1678BBC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_13:*:*:*:*:*:*",
"matchCriteriaId": "9D265542-5333-4CCD-90E5-B5F6A55F9863",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_14:*:*:*:*:*:*",
"matchCriteriaId": "1763CD8B-3ACD-4617-A1CA-B9F77A074977",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_15:*:*:*:*:*:*",
"matchCriteriaId": "F25C66AA-B60D-413C-A848-51E12D6080AC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_16:*:*:*:*:*:*",
"matchCriteriaId": "071A0D53-EC95-4B18-9FA3-55208B1F7B94",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_17:*:*:*:*:*:*",
"matchCriteriaId": "CC26A9D4-14D6-46B1-BB00-A2C4386EBCA4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_18:*:*:*:*:*:*",
"matchCriteriaId": "350CDEDA-9A20-4BC3-BEAE-8346CED10CD6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_19:*:*:*:*:*:*",
"matchCriteriaId": "10C6107E-79B3-4672-B3E5-8A2FA9A829CF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_2:*:*:*:*:*:*",
"matchCriteriaId": "3233D306-3F8E-40A4-B132-7264E63DD131",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_3:*:*:*:*:*:*",
"matchCriteriaId": "9EAEA45A-0370-475E-B4CB-395A434DC3A1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_4:*:*:*:*:*:*",
"matchCriteriaId": "39310F05-1DB6-43BA-811C-9CB91D6DCF20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_5:*:*:*:*:*:*",
"matchCriteriaId": "D6135B16-C89E-4F49-BA15-823E2AF26D68",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_6:*:*:*:*:*:*",
"matchCriteriaId": "CC887BEC-915B-44AC-B473-5448B3D8DCF7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_7:*:*:*:*:*:*",
"matchCriteriaId": "D7A7CC60-C294-41EC-B000-D15AAA93A3D5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_8:*:*:*:*:*:*",
"matchCriteriaId": "022132F8-6E56-4A29-95D6-3B7861D39CDF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_9:*:*:*:*:*:*",
"matchCriteriaId": "651DA9B7-9C11-47A7-AF5C-95625C8FFF6A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:-:*:*:*:*:*:*",
"matchCriteriaId": "8CAAE1B7-982E-4D50-9651-DEEE6CD74EED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_1:*:*:*:*:*:*",
"matchCriteriaId": "AFCF99EC-3384-418D-A419-B9DB607BE371",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_2:*:*:*:*:*:*",
"matchCriteriaId": "31E05134-A0C5-4937-A228-7D0884276B67",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_3:*:*:*:*:*:*",
"matchCriteriaId": "3F06C4AD-FD20-4345-8386-0895312F0A00",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_4:*:*:*:*:*:*",
"matchCriteriaId": "98CC25E2-EC3D-43A2-8D03-06F0E804EA63",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:*",
"matchCriteriaId": "73CDC2CC-EE82-4010-88E5-EDC175DA4D47",
"versionEndExcluding": "7.3.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The Flags module in Liferay Portal 7.3.1 and earlier, and Liferay DXP 7.0 before fix pack 96, 7.1 before fix pack 20, and 7.2 before fix pack 5, does not limit the rate at which content can be flagged as inappropriate, which allows remote authenticated users to spam the site administrator with emails"
},
{
"lang": "es",
"value": "El m\u00f3dulo Flags en Liferay Portal versiones 7.3.1 y anteriores, y Liferay DXP versiones 7.0 anteriores a fix pack 96, versiones 7.1 anteriores a fix pack 20, y versiones 7.2 anteriores a fix pack 5, no limita la velocidad a la que el contenido puede ser marcado como inapropiado, que permite a usuarios autenticado remoto hacer spam al administrador del sitio con correos electr\u00f3nicos"
}
],
"id": "CVE-2021-33320",
"lastModified": "2024-11-21T06:08:40.897",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.0,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:S/C:N/I:N/A:P",
"version": "2.0"
},
"exploitabilityScore": 8.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 1.4,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2021-08-03T19:15:08.557",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://issues.liferay.com/browse/LPE-17007"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Release Notes",
"Vendor Advisory"
],
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120747590"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://issues.liferay.com/browse/LPE-17007"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Release Notes",
"Vendor Advisory"
],
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120747590"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-770"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2021-08-03 21:15
Modified
2024-11-21 06:08
Severity ?
Summary
Cross-site scripting (XSS) vulnerability in the Portlet Configuration module in Liferay Portal 7.1.0 through 7.3.2, and Liferay DXP 7.1 before fix pack 19, and 7.2 before fix pack 7, allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_portlet_configuration_css_web_portlet_PortletConfigurationCSSPortlet_portletResource parameter.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | https://issues.liferay.com/browse/LPE-17053 | Patch, Vendor Advisory | |
| cve@mitre.org | https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120748366 | Release Notes, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://issues.liferay.com/browse/LPE-17053 | Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120748366 | Release Notes, Vendor Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | liferay_portal | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:-:*:*:*:*:*:*",
"matchCriteriaId": "C2AA7E18-A41B-4F0D-A04F-57C5745D091B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_1:*:*:*:*:*:*",
"matchCriteriaId": "392B783D-620D-4C71-AAA0-848B16964A27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_10:*:*:*:*:*:*",
"matchCriteriaId": "4F5A94E2-22B7-4D2D-A491-29F395E727C5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_11:*:*:*:*:*:*",
"matchCriteriaId": "E9B10908-C42B-4763-9D47-236506B0E84A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_12:*:*:*:*:*:*",
"matchCriteriaId": "CF544435-36AC-49B8-BA50-A6B6D1678BBC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_13:*:*:*:*:*:*",
"matchCriteriaId": "9D265542-5333-4CCD-90E5-B5F6A55F9863",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_14:*:*:*:*:*:*",
"matchCriteriaId": "1763CD8B-3ACD-4617-A1CA-B9F77A074977",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_15:*:*:*:*:*:*",
"matchCriteriaId": "F25C66AA-B60D-413C-A848-51E12D6080AC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_16:*:*:*:*:*:*",
"matchCriteriaId": "071A0D53-EC95-4B18-9FA3-55208B1F7B94",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_17:*:*:*:*:*:*",
"matchCriteriaId": "CC26A9D4-14D6-46B1-BB00-A2C4386EBCA4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_18:*:*:*:*:*:*",
"matchCriteriaId": "350CDEDA-9A20-4BC3-BEAE-8346CED10CD6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_2:*:*:*:*:*:*",
"matchCriteriaId": "3233D306-3F8E-40A4-B132-7264E63DD131",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_3:*:*:*:*:*:*",
"matchCriteriaId": "9EAEA45A-0370-475E-B4CB-395A434DC3A1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_4:*:*:*:*:*:*",
"matchCriteriaId": "39310F05-1DB6-43BA-811C-9CB91D6DCF20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_5:*:*:*:*:*:*",
"matchCriteriaId": "D6135B16-C89E-4F49-BA15-823E2AF26D68",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_6:*:*:*:*:*:*",
"matchCriteriaId": "CC887BEC-915B-44AC-B473-5448B3D8DCF7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_7:*:*:*:*:*:*",
"matchCriteriaId": "D7A7CC60-C294-41EC-B000-D15AAA93A3D5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_8:*:*:*:*:*:*",
"matchCriteriaId": "022132F8-6E56-4A29-95D6-3B7861D39CDF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_9:*:*:*:*:*:*",
"matchCriteriaId": "651DA9B7-9C11-47A7-AF5C-95625C8FFF6A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:-:*:*:*:*:*:*",
"matchCriteriaId": "8CAAE1B7-982E-4D50-9651-DEEE6CD74EED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_1:*:*:*:*:*:*",
"matchCriteriaId": "AFCF99EC-3384-418D-A419-B9DB607BE371",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_2:*:*:*:*:*:*",
"matchCriteriaId": "31E05134-A0C5-4937-A228-7D0884276B67",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_3:*:*:*:*:*:*",
"matchCriteriaId": "3F06C4AD-FD20-4345-8386-0895312F0A00",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_4:*:*:*:*:*:*",
"matchCriteriaId": "98CC25E2-EC3D-43A2-8D03-06F0E804EA63",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_5:*:*:*:*:*:*",
"matchCriteriaId": "30933C36-C710-488F-9601-EE1BB749C58A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_6:*:*:*:*:*:*",
"matchCriteriaId": "41E94372-A1AE-48B1-82DC-08B7B616473F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:*",
"matchCriteriaId": "B2635CDB-89E9-4B43-AE62-4D91ACF42299",
"versionEndExcluding": "7.3.3",
"versionStartIncluding": "7.1.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in the Portlet Configuration module in Liferay Portal 7.1.0 through 7.3.2, and Liferay DXP 7.1 before fix pack 19, and 7.2 before fix pack 7, allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_portlet_configuration_css_web_portlet_PortletConfigurationCSSPortlet_portletResource parameter."
},
{
"lang": "es",
"value": "Una vulnerabilidad de tipo Cross-site scripting (XSS) en el m\u00f3dulo Portlet Configuration en Liferay Portal versiones 7.1.0 hasta 7.3.2, y Liferay DXP versiones 7.1 anteriores a fix pack 19, y versiones 7.2 anteriores a fix pack 7, permite a atacantes remotos inyectar script web o HTML arbitrario por medio del par\u00e1metro _com_liferay_portlet_configuration_css_web_portlet_PortletConfigurationCSSPortlet_portletResource"
}
],
"id": "CVE-2021-33332",
"lastModified": "2024-11-21T06:08:42.613",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2021-08-03T21:15:08.537",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://issues.liferay.com/browse/LPE-17053"
},
{
"source": "cve@mitre.org",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120748366"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://issues.liferay.com/browse/LPE-17053"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120748366"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2020-07-20 02:15
Modified
2024-11-21 05:06
Severity ?
8.3 (High) - CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
Liferay Portal before 7.3.0, and Liferay DXP 7.0 before fix pack 89, 7.1 before fix pack 17, and 7.2 before fix pack 4, does not safely test a connection to a LDAP server, which allows remote attackers to obtain the LDAP server's password via the Test LDAP Connection feature.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | https://issues.liferay.com/browse/LPE-16928 | Issue Tracking, Vendor Advisory | |
| cve@mitre.org | https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/119317439 | Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://issues.liferay.com/browse/LPE-16928 | Issue Tracking, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/119317439 | Patch, Vendor Advisory |
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "726967CC-1BE0-48AB-8BD1-BE4B09ADFD36",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_13:*:*:*:*:*:*",
"matchCriteriaId": "4874012D-52AA-4C32-95E9-BD331225B4E6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_14:*:*:*:*:*:*",
"matchCriteriaId": "21CAF86F-CEC9-44EE-BAF8-0F7AF9D945F5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_24:*:*:*:*:*:*",
"matchCriteriaId": "EF6C9F29-EEFF-4737-BD50-58572D6C14E9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_25:*:*:*:*:*:*",
"matchCriteriaId": "D24E1FA0-BD94-4AFC-92BF-AEDEBC7DCF4B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_26:*:*:*:*:*:*",
"matchCriteriaId": "FF9B54EE-973B-44B4-8EA2-B58FA49AC561",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_27:*:*:*:*:*:*",
"matchCriteriaId": "A9637223-557D-474B-A46B-D276866376C3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_28:*:*:*:*:*:*",
"matchCriteriaId": "F6306F9C-99DE-4F94-8E7F-6747762BEC45",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_3\\+:*:*:*:*:*:*",
"matchCriteriaId": "2DFF08F0-77C1-43A0-B7DD-9B905BE074EB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_30:*:*:*:*:*:*",
"matchCriteriaId": "48B7015C-26B9-453E-B3CF-9B220D3A8024",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_33:*:*:*:*:*:*",
"matchCriteriaId": "0FEB6921-3C45-4B7E-8B34-CDC34984583D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_35:*:*:*:*:*:*",
"matchCriteriaId": "525F45DC-2E5C-46A8-AEDF-9D6B8FA2EB11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_36:*:*:*:*:*:*",
"matchCriteriaId": "55755D0C-4C0C-42D9-BE5E-5D33C8BA4C7F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_39:*:*:*:*:*:*",
"matchCriteriaId": "FB4FE0F9-EB19-45D7-A953-674629D951F5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_40:*:*:*:*:*:*",
"matchCriteriaId": "22E4B63F-01A9-4F85-92BC-A51F41BE4121",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_41:*:*:*:*:*:*",
"matchCriteriaId": "23BE441D-8770-4F4D-86CD-4E53161F54FB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_42:*:*:*:*:*:*",
"matchCriteriaId": "E14FF010-3907-4C79-B945-C792E446CB31",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_43:*:*:*:*:*:*",
"matchCriteriaId": "B97B5817-B55E-485D-9747-3A50CF7245C8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_44:*:*:*:*:*:*",
"matchCriteriaId": "19EBD671-56BD-45D3-9248-DAF3F47B36FD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_45:*:*:*:*:*:*",
"matchCriteriaId": "93EDC2A1-9622-44DB-ABA8-754D61B60787",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_46:*:*:*:*:*:*",
"matchCriteriaId": "B4B6A06D-C323-431C-9A65-4FD6A6E4CAB6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_47:*:*:*:*:*:*",
"matchCriteriaId": "EE6D4466-1C3A-4D5A-A65C-A30A87EADF1A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_48:*:*:*:*:*:*",
"matchCriteriaId": "4F0BC40A-8E13-4665-A2E4-F5815CA70E17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_49:*:*:*:*:*:*",
"matchCriteriaId": "11FB69C3-7755-495A-AB76-201AF4D9623B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_50:*:*:*:*:*:*",
"matchCriteriaId": "FF66F652-6C08-4D47-865D-36E70360B632",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_51:*:*:*:*:*:*",
"matchCriteriaId": "17B68D59-0509-4C6A-B803-03A02EB76F1F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_52:*:*:*:*:*:*",
"matchCriteriaId": "8F69B287-3B86-4B64-BCB4-40E9495A628D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_53:*:*:*:*:*:*",
"matchCriteriaId": "C627090E-A1BF-4332-9538-EE4E184DB65E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_54:*:*:*:*:*:*",
"matchCriteriaId": "9A089471-9944-4C75-A25F-1F23C18C0CF0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_56:*:*:*:*:*:*",
"matchCriteriaId": "B90E7FBF-6B5B-457A-8B20-ECA69A626BB8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_57:*:*:*:*:*:*",
"matchCriteriaId": "1975C1AB-EF50-42E2-9879-17FB763B45F9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_58:*:*:*:*:*:*",
"matchCriteriaId": "DFB7BB13-773B-47A6-A001-B9EBA46C917E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_59:*:*:*:*:*:*",
"matchCriteriaId": "1C4A2D39-3725-4E80-9F3F-AC1F4EE662E8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_60:*:*:*:*:*:*",
"matchCriteriaId": "BAEDF88B-B9C8-4891-B199-A72C066FC7BF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_61:*:*:*:*:*:*",
"matchCriteriaId": "F768E1DD-3DC6-4783-82DE-D089C7CD3C63",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_64:*:*:*:*:*:*",
"matchCriteriaId": "426EDA92-FE5A-4523-8AAE-1E5D5D67F535",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_65:*:*:*:*:*:*",
"matchCriteriaId": "070CB609-6D4B-4817-9F91-00BD62423E56",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_66:*:*:*:*:*:*",
"matchCriteriaId": "FEE87846-A4CF-47E5-93AA-5D7E2548D28D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_67:*:*:*:*:*:*",
"matchCriteriaId": "A4C11B0E-6D94-4A65-83BE-1E5828710CB9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_68:*:*:*:*:*:*",
"matchCriteriaId": "F1DC73B1-4017-424F-A28D-F54F2FA8ED8C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_69:*:*:*:*:*:*",
"matchCriteriaId": "32B4FD3C-7BB7-4DA2-9A3A-05A6370B9745",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_70:*:*:*:*:*:*",
"matchCriteriaId": "71293E5B-4DCC-47BC-A493-3540D57E6067",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_71:*:*:*:*:*:*",
"matchCriteriaId": "56A8940B-318E-4C6A-9131-A50E90E82C28",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_72:*:*:*:*:*:*",
"matchCriteriaId": "F09B5E82-DC18-4B07-9A05-E433579B4FB5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_73:*:*:*:*:*:*",
"matchCriteriaId": "CE25D189-2D6F-4229-BF09-2CEA0A6C5D50",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_75:*:*:*:*:*:*",
"matchCriteriaId": "36549BE5-DEDB-408A-BFC9-AB00031D45DD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_76:*:*:*:*:*:*",
"matchCriteriaId": "E11B8075-4212-41CB-85AC-09FA1CDB86A1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_78:*:*:*:*:*:*",
"matchCriteriaId": "80412DCE-D79F-492A-8788-6A43C4D76D7C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_79:*:*:*:*:*:*",
"matchCriteriaId": "BC7A939F-21D1-4AF1-BAB9-E91DFCFFB7A2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_80:*:*:*:*:*:*",
"matchCriteriaId": "5F2240FC-EDDC-47F5-B713-07FF2D23CE00",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_81:*:*:*:*:*:*",
"matchCriteriaId": "5006AAE4-B154-468A-850C-20171965E2AC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:*:*:*:*:*:*:*",
"matchCriteriaId": "980981E7-41E3-4F67-A90C-4460BE4CA62A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_1:*:*:*:*:*:*",
"matchCriteriaId": "392B783D-620D-4C71-AAA0-848B16964A27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_10:*:*:*:*:*:*",
"matchCriteriaId": "4F5A94E2-22B7-4D2D-A491-29F395E727C5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_11:*:*:*:*:*:*",
"matchCriteriaId": "E9B10908-C42B-4763-9D47-236506B0E84A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_12:*:*:*:*:*:*",
"matchCriteriaId": "CF544435-36AC-49B8-BA50-A6B6D1678BBC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_13:*:*:*:*:*:*",
"matchCriteriaId": "9D265542-5333-4CCD-90E5-B5F6A55F9863",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_14:*:*:*:*:*:*",
"matchCriteriaId": "1763CD8B-3ACD-4617-A1CA-B9F77A074977",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_15:*:*:*:*:*:*",
"matchCriteriaId": "F25C66AA-B60D-413C-A848-51E12D6080AC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_16:*:*:*:*:*:*",
"matchCriteriaId": "071A0D53-EC95-4B18-9FA3-55208B1F7B94",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_2:*:*:*:*:*:*",
"matchCriteriaId": "3233D306-3F8E-40A4-B132-7264E63DD131",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_3:*:*:*:*:*:*",
"matchCriteriaId": "9EAEA45A-0370-475E-B4CB-395A434DC3A1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_4:*:*:*:*:*:*",
"matchCriteriaId": "39310F05-1DB6-43BA-811C-9CB91D6DCF20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_5:*:*:*:*:*:*",
"matchCriteriaId": "D6135B16-C89E-4F49-BA15-823E2AF26D68",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_6:*:*:*:*:*:*",
"matchCriteriaId": "CC887BEC-915B-44AC-B473-5448B3D8DCF7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_7:*:*:*:*:*:*",
"matchCriteriaId": "D7A7CC60-C294-41EC-B000-D15AAA93A3D5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_8:*:*:*:*:*:*",
"matchCriteriaId": "022132F8-6E56-4A29-95D6-3B7861D39CDF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_9:*:*:*:*:*:*",
"matchCriteriaId": "651DA9B7-9C11-47A7-AF5C-95625C8FFF6A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:*:*:*:*:*:*:*",
"matchCriteriaId": "597580A0-6E74-41D5-9242-9187AF618AD8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_1:*:*:*:*:*:*",
"matchCriteriaId": "AFCF99EC-3384-418D-A419-B9DB607BE371",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_2:*:*:*:*:*:*",
"matchCriteriaId": "31E05134-A0C5-4937-A228-7D0884276B67",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_3:*:*:*:*:*:*",
"matchCriteriaId": "3F06C4AD-FD20-4345-8386-0895312F0A00",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:*",
"matchCriteriaId": "8B61E29C-3071-41EF-9774-185F91282DEB",
"versionEndExcluding": "7.3.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Liferay Portal before 7.3.0, and Liferay DXP 7.0 before fix pack 89, 7.1 before fix pack 17, and 7.2 before fix pack 4, does not safely test a connection to a LDAP server, which allows remote attackers to obtain the LDAP server\u0027s password via the Test LDAP Connection feature."
},
{
"lang": "es",
"value": "Liferay Portal versiones anteriores a 7.3.0, y Liferay DXP versi\u00f3n 7.0 anterior al paquete de correcci\u00f3n 89, versi\u00f3n 7.1 anterior al paquete de correcci\u00f3n 17, y versi\u00f3n 7.2 anterior al paquete de correcci\u00f3n 4, no prueba de forma segura una conexi\u00f3n a un servidor LDAP, lo que permite a los atacantes remotos obtener la contrase\u00f1a del servidor LDAP a trav\u00e9s de la funci\u00f3n Probar conexi\u00f3n LDAP"
}
],
"id": "CVE-2020-15841",
"lastModified": "2024-11-21T05:06:17.933",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.6,
"impactScore": 6.0,
"source": "cve@mitre.org",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2020-07-20T02:15:11.347",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Issue Tracking",
"Vendor Advisory"
],
"url": "https://issues.liferay.com/browse/LPE-16928"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/119317439"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Issue Tracking",
"Vendor Advisory"
],
"url": "https://issues.liferay.com/browse/LPE-16928"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/119317439"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-noinfo"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2024-02-08 04:15
Modified
2024-11-21 09:00
Severity ?
5.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
5.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
5.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Summary
Liferay Portal 7.2.0 through 7.4.1, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 18, and older unsupported versions returns with different responses depending on whether a site does not exist or if the user does not have permission to access the site, which allows remote attackers to discover the existence of sites by enumerating URLs. This vulnerability occurs if locale.prepend.friendly.url.style=2 and if a custom 404 page is used.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.3 | |
| liferay | dxp | 7.3 | |
| liferay | dxp | 7.3 | |
| liferay | liferay_portal | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:-:*:*:*:*:*:*",
"matchCriteriaId": "8CAAE1B7-982E-4D50-9651-DEEE6CD74EED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_1:*:*:*:*:*:*",
"matchCriteriaId": "AFCF99EC-3384-418D-A419-B9DB607BE371",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_10:*:*:*:*:*:*",
"matchCriteriaId": "F7CAAF53-AA8E-48CB-9398-35461BE590C4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_11:*:*:*:*:*:*",
"matchCriteriaId": "6FB8482E-644B-4DA5-808B-8DBEAB6D8D09",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_12:*:*:*:*:*:*",
"matchCriteriaId": "95EFE8B5-EE95-4186-AC89-E9AFD8649D01",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_13:*:*:*:*:*:*",
"matchCriteriaId": "90A6E0AF-0B8A-462D-95EF-2239EEE4A50D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_14:*:*:*:*:*:*",
"matchCriteriaId": "48BBAE90-F668-49BF-89AF-2C9547B76836",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_15:*:*:*:*:*:*",
"matchCriteriaId": "74FAF597-EAAD-4BB5-AB99-8129476A7E89",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_16:*:*:*:*:*:*",
"matchCriteriaId": "20F078A3-A3EE-4CCA-816D-3C053E7D7FE3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_17:*:*:*:*:*:*",
"matchCriteriaId": "C33EBD80-91DD-401C-9337-171C07B5D489",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_2:*:*:*:*:*:*",
"matchCriteriaId": "31E05134-A0C5-4937-A228-7D0884276B67",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_3:*:*:*:*:*:*",
"matchCriteriaId": "3F06C4AD-FD20-4345-8386-0895312F0A00",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_4:*:*:*:*:*:*",
"matchCriteriaId": "98CC25E2-EC3D-43A2-8D03-06F0E804EA63",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_5:*:*:*:*:*:*",
"matchCriteriaId": "30933C36-C710-488F-9601-EE1BB749C58A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_6:*:*:*:*:*:*",
"matchCriteriaId": "41E94372-A1AE-48B1-82DC-08B7B616473F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_7:*:*:*:*:*:*",
"matchCriteriaId": "51FBC8E0-34F8-475C-A1A8-571791CA05F9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_8:*:*:*:*:*:*",
"matchCriteriaId": "1E73EAEA-FA88-46B9-B9D5-A41603957AD7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_9:*:*:*:*:*:*",
"matchCriteriaId": "CF9BC654-4E3F-4B40-A6E5-79A818A51BED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.3:-:*:*:*:*:*:*",
"matchCriteriaId": "21C55D41-DB66-494D-BEEB-BDAC7CB4B31B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.3:sp1:*:*:*:*:*:*",
"matchCriteriaId": "9D75A0FF-BAEA-471A-87B2-8EC2A9F0A6B5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.3:sp2:*:*:*:*:*:*",
"matchCriteriaId": "D86CDCC0-9655-477B-83FA-ADDBB5AF43A2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:*",
"matchCriteriaId": "F247D45A-D3E4-4EDD-A18D-147FFBEF0935",
"versionEndIncluding": "7.4.1",
"versionStartIncluding": "7.2.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Liferay Portal 7.2.0 through 7.4.1, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 18, and older unsupported versions returns with different responses depending on whether a site does not exist or if the user does not have permission to access the site, which allows remote attackers to discover the existence of sites by enumerating URLs. This vulnerability occurs if locale.prepend.friendly.url.style=2 and if a custom 404 page is used."
},
{
"lang": "es",
"value": "Liferay Portal 7.2.0 a 7.4.1 y versiones anteriores no compatibles, y Liferay DXP 7.3 anterior al service pack 3, 7.2 anterior al fix pack 18 y versiones anteriores no compatibles devuelven respuestas diferentes dependiendo de si un sitio no existe o si el usuario no tiene permiso para acceder al sitio, lo que permite a atacantes remotos descubrir la existencia de sitios enumerando las URL. Esta vulnerabilidad ocurre si locale.prepend.friendly.url.style=2 y si se utiliza una p\u00e1gina 404 personalizada."
}
],
"id": "CVE-2024-25146",
"lastModified": "2024-11-21T09:00:20.870",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 1.4,
"source": "security@liferay.com",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 1.4,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2024-02-08T04:15:08.040",
"references": [
{
"source": "security@liferay.com",
"tags": [
"Vendor Advisory"
],
"url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25146"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25146"
}
],
"sourceIdentifier": "security@liferay.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-204"
}
],
"source": "security@liferay.com",
"type": "Secondary"
},
{
"description": [
{
"lang": "en",
"value": "CWE-203"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2021-05-17 12:15
Modified
2024-11-21 06:00
Severity ?
Summary
Cross-site scripting (XSS) vulnerability in the Layout module's page administration page in Liferay Portal 7.3.4, 7.3.5 and Liferay DXP 7.2 before fix pack 11 and 7.3 before fix pack 1 allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_layout_admin_web_portlet_GroupPagesPortlet_name parameter.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:-:*:*:*:*:*:*",
"matchCriteriaId": "8CAAE1B7-982E-4D50-9651-DEEE6CD74EED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_1:*:*:*:*:*:*",
"matchCriteriaId": "AFCF99EC-3384-418D-A419-B9DB607BE371",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_10:*:*:*:*:*:*",
"matchCriteriaId": "F7CAAF53-AA8E-48CB-9398-35461BE590C4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_2:*:*:*:*:*:*",
"matchCriteriaId": "31E05134-A0C5-4937-A228-7D0884276B67",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_3:*:*:*:*:*:*",
"matchCriteriaId": "3F06C4AD-FD20-4345-8386-0895312F0A00",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_4:*:*:*:*:*:*",
"matchCriteriaId": "98CC25E2-EC3D-43A2-8D03-06F0E804EA63",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_5:*:*:*:*:*:*",
"matchCriteriaId": "30933C36-C710-488F-9601-EE1BB749C58A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_6:*:*:*:*:*:*",
"matchCriteriaId": "41E94372-A1AE-48B1-82DC-08B7B616473F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_7:*:*:*:*:*:*",
"matchCriteriaId": "51FBC8E0-34F8-475C-A1A8-571791CA05F9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_8:*:*:*:*:*:*",
"matchCriteriaId": "1E73EAEA-FA88-46B9-B9D5-A41603957AD7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_9:*:*:*:*:*:*",
"matchCriteriaId": "CF9BC654-4E3F-4B40-A6E5-79A818A51BED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.3:-:*:*:*:*:*:*",
"matchCriteriaId": "21C55D41-DB66-494D-BEEB-BDAC7CB4B31B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:liferay_portal:7.3.4:*:*:*:*:*:*:*",
"matchCriteriaId": "2C673509-5436-44DF-AFCE-BE5C3188D62F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:liferay_portal:7.3.5:*:*:*:*:*:*:*",
"matchCriteriaId": "2B842A08-1EDB-4232-89C9-9B966E251B3B",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in the Layout module\u0027s page administration page in Liferay Portal 7.3.4, 7.3.5 and Liferay DXP 7.2 before fix pack 11 and 7.3 before fix pack 1 allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_layout_admin_web_portlet_GroupPagesPortlet_name parameter."
},
{
"lang": "es",
"value": "Una vulnerabilidad de tipo cross-site scripting (XSS) en la p\u00e1gina de administraci\u00f3n page del m\u00f3dulo Layout en Liferay Portal versiones 7.3.4, 7.3.5 y Liferay DXP versiones 7.2 anteriores a fixpack 11 y versiones 7.3 anteriores a fixpack 1, permite a atacantes remotos inyectar un script web o HTML arbitrario por medio del par\u00e1metro _com_liferay_layout_admin_web_portlet_GroupPagesPortlet_name"
}
],
"id": "CVE-2021-29048",
"lastModified": "2024-11-21T06:00:35.617",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2021-05-17T12:15:07.427",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://liferay.com"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120743601"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://liferay.com"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120743601"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2022-11-15 00:15
Modified
2024-11-21 07:24
Severity ?
Summary
A Cross-site scripting (XSS) vulnerability in the Announcements module in Liferay Portal 7.1.0 through 7.4.2, and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 17, and 7.3 before service pack 3 allows remote attackers to inject arbitrary web script or HTML.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| liferay | liferay_portal | * | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.3 | |
| liferay | dxp | 7.3 | |
| liferay | dxp | 7.3 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:*",
"matchCriteriaId": "201470D2-65E1-40D7-B01B-35A03930BEEA",
"versionEndIncluding": "7.4.2",
"versionStartIncluding": "7.1.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:-:*:*:*:*:*:*",
"matchCriteriaId": "C2AA7E18-A41B-4F0D-A04F-57C5745D091B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_1:*:*:*:*:*:*",
"matchCriteriaId": "392B783D-620D-4C71-AAA0-848B16964A27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_10:*:*:*:*:*:*",
"matchCriteriaId": "4F5A94E2-22B7-4D2D-A491-29F395E727C5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_11:*:*:*:*:*:*",
"matchCriteriaId": "E9B10908-C42B-4763-9D47-236506B0E84A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_12:*:*:*:*:*:*",
"matchCriteriaId": "CF544435-36AC-49B8-BA50-A6B6D1678BBC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_13:*:*:*:*:*:*",
"matchCriteriaId": "9D265542-5333-4CCD-90E5-B5F6A55F9863",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_14:*:*:*:*:*:*",
"matchCriteriaId": "1763CD8B-3ACD-4617-A1CA-B9F77A074977",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_15:*:*:*:*:*:*",
"matchCriteriaId": "F25C66AA-B60D-413C-A848-51E12D6080AC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_16:*:*:*:*:*:*",
"matchCriteriaId": "071A0D53-EC95-4B18-9FA3-55208B1F7B94",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_17:*:*:*:*:*:*",
"matchCriteriaId": "CC26A9D4-14D6-46B1-BB00-A2C4386EBCA4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_18:*:*:*:*:*:*",
"matchCriteriaId": "350CDEDA-9A20-4BC3-BEAE-8346CED10CD6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_19:*:*:*:*:*:*",
"matchCriteriaId": "10C6107E-79B3-4672-B3E5-8A2FA9A829CF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_2:*:*:*:*:*:*",
"matchCriteriaId": "3233D306-3F8E-40A4-B132-7264E63DD131",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_20:*:*:*:*:*:*",
"matchCriteriaId": "A978B14E-96F6-449F-8D8D-8E782A5A3D19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_21:*:*:*:*:*:*",
"matchCriteriaId": "87600A59-7DD1-49F5-A5A5-EA392193C6A3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_22:*:*:*:*:*:*",
"matchCriteriaId": "33EB9718-E83C-43F4-AFF9-86A83F6F75A4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_23:*:*:*:*:*:*",
"matchCriteriaId": "F7CDDDE5-5E00-41AB-8517-2E5A1427633D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_24:*:*:*:*:*:*",
"matchCriteriaId": "D5B4F901-D5A9-440D-86B4-76B42C833660",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_25:*:*:*:*:*:*",
"matchCriteriaId": "1AB262B6-E817-461A-9F05-15B1B37D9019",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_3:*:*:*:*:*:*",
"matchCriteriaId": "9EAEA45A-0370-475E-B4CB-395A434DC3A1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_4:*:*:*:*:*:*",
"matchCriteriaId": "39310F05-1DB6-43BA-811C-9CB91D6DCF20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_5:*:*:*:*:*:*",
"matchCriteriaId": "D6135B16-C89E-4F49-BA15-823E2AF26D68",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_6:*:*:*:*:*:*",
"matchCriteriaId": "CC887BEC-915B-44AC-B473-5448B3D8DCF7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_7:*:*:*:*:*:*",
"matchCriteriaId": "D7A7CC60-C294-41EC-B000-D15AAA93A3D5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_8:*:*:*:*:*:*",
"matchCriteriaId": "022132F8-6E56-4A29-95D6-3B7861D39CDF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_9:*:*:*:*:*:*",
"matchCriteriaId": "651DA9B7-9C11-47A7-AF5C-95625C8FFF6A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:-:*:*:*:*:*:*",
"matchCriteriaId": "8CAAE1B7-982E-4D50-9651-DEEE6CD74EED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_1:*:*:*:*:*:*",
"matchCriteriaId": "AFCF99EC-3384-418D-A419-B9DB607BE371",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_10:*:*:*:*:*:*",
"matchCriteriaId": "F7CAAF53-AA8E-48CB-9398-35461BE590C4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_11:*:*:*:*:*:*",
"matchCriteriaId": "6FB8482E-644B-4DA5-808B-8DBEAB6D8D09",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_12:*:*:*:*:*:*",
"matchCriteriaId": "95EFE8B5-EE95-4186-AC89-E9AFD8649D01",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_13:*:*:*:*:*:*",
"matchCriteriaId": "90A6E0AF-0B8A-462D-95EF-2239EEE4A50D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_14:*:*:*:*:*:*",
"matchCriteriaId": "48BBAE90-F668-49BF-89AF-2C9547B76836",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_15:*:*:*:*:*:*",
"matchCriteriaId": "74FAF597-EAAD-4BB5-AB99-8129476A7E89",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_2:*:*:*:*:*:*",
"matchCriteriaId": "31E05134-A0C5-4937-A228-7D0884276B67",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_3:*:*:*:*:*:*",
"matchCriteriaId": "3F06C4AD-FD20-4345-8386-0895312F0A00",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_4:*:*:*:*:*:*",
"matchCriteriaId": "98CC25E2-EC3D-43A2-8D03-06F0E804EA63",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_5:*:*:*:*:*:*",
"matchCriteriaId": "30933C36-C710-488F-9601-EE1BB749C58A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_6:*:*:*:*:*:*",
"matchCriteriaId": "41E94372-A1AE-48B1-82DC-08B7B616473F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_7:*:*:*:*:*:*",
"matchCriteriaId": "51FBC8E0-34F8-475C-A1A8-571791CA05F9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_8:*:*:*:*:*:*",
"matchCriteriaId": "1E73EAEA-FA88-46B9-B9D5-A41603957AD7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_9:*:*:*:*:*:*",
"matchCriteriaId": "CF9BC654-4E3F-4B40-A6E5-79A818A51BED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.3:-:*:*:*:*:*:*",
"matchCriteriaId": "21C55D41-DB66-494D-BEEB-BDAC7CB4B31B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.3:sp1:*:*:*:*:*:*",
"matchCriteriaId": "9D75A0FF-BAEA-471A-87B2-8EC2A9F0A6B5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.3:sp2:*:*:*:*:*:*",
"matchCriteriaId": "D86CDCC0-9655-477B-83FA-ADDBB5AF43A2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A Cross-site scripting (XSS) vulnerability in the Announcements module in Liferay Portal 7.1.0 through 7.4.2, and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 17, and 7.3 before service pack 3 allows remote attackers to inject arbitrary web script or HTML."
},
{
"lang": "es",
"value": "Una vulnerabilidad de Cross-Site Scripring (XSS) en el m\u00f3dulo Announcements en Liferay Portal 7.1.0 a 7.4.2 y Liferay DXP 7.1 antes del fix pack 27, 7.2 antes del fix pack 17 y 7.3 antes del service pack 3 permite a atacantes remotos inyectar script web arbitrario o HTML."
}
],
"id": "CVE-2022-42110",
"lastModified": "2024-11-21T07:24:22.523",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2022-11-15T00:15:12.817",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "https://issues.liferay.com/browse/LPE-17403"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42110"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://issues.liferay.com/browse/LPE-17403"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42110"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2021-05-17 12:15
Modified
2024-11-21 06:00
Severity ?
Summary
Cross-site scripting (XSS) vulnerability in the Asset module's Asset Publisher app in Liferay Portal 7.2.1 through 7.3.5, and Liferay DXP 7.1 before fix pack 21, 7.2 before fix pack 10 and 7.3 before fix pack 1 allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_XXXXXXXXXXXX_assetEntryId parameter.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.3 | |
| liferay | liferay_portal | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:-:*:*:*:*:*:*",
"matchCriteriaId": "C2AA7E18-A41B-4F0D-A04F-57C5745D091B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_1:*:*:*:*:*:*",
"matchCriteriaId": "392B783D-620D-4C71-AAA0-848B16964A27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_10:*:*:*:*:*:*",
"matchCriteriaId": "4F5A94E2-22B7-4D2D-A491-29F395E727C5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_11:*:*:*:*:*:*",
"matchCriteriaId": "E9B10908-C42B-4763-9D47-236506B0E84A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_12:*:*:*:*:*:*",
"matchCriteriaId": "CF544435-36AC-49B8-BA50-A6B6D1678BBC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_13:*:*:*:*:*:*",
"matchCriteriaId": "9D265542-5333-4CCD-90E5-B5F6A55F9863",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_14:*:*:*:*:*:*",
"matchCriteriaId": "1763CD8B-3ACD-4617-A1CA-B9F77A074977",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_15:*:*:*:*:*:*",
"matchCriteriaId": "F25C66AA-B60D-413C-A848-51E12D6080AC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_16:*:*:*:*:*:*",
"matchCriteriaId": "071A0D53-EC95-4B18-9FA3-55208B1F7B94",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_17:*:*:*:*:*:*",
"matchCriteriaId": "CC26A9D4-14D6-46B1-BB00-A2C4386EBCA4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_18:*:*:*:*:*:*",
"matchCriteriaId": "350CDEDA-9A20-4BC3-BEAE-8346CED10CD6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_19:*:*:*:*:*:*",
"matchCriteriaId": "10C6107E-79B3-4672-B3E5-8A2FA9A829CF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_2:*:*:*:*:*:*",
"matchCriteriaId": "3233D306-3F8E-40A4-B132-7264E63DD131",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_20:*:*:*:*:*:*",
"matchCriteriaId": "A978B14E-96F6-449F-8D8D-8E782A5A3D19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_3:*:*:*:*:*:*",
"matchCriteriaId": "9EAEA45A-0370-475E-B4CB-395A434DC3A1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_4:*:*:*:*:*:*",
"matchCriteriaId": "39310F05-1DB6-43BA-811C-9CB91D6DCF20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_5:*:*:*:*:*:*",
"matchCriteriaId": "D6135B16-C89E-4F49-BA15-823E2AF26D68",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_6:*:*:*:*:*:*",
"matchCriteriaId": "CC887BEC-915B-44AC-B473-5448B3D8DCF7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_7:*:*:*:*:*:*",
"matchCriteriaId": "D7A7CC60-C294-41EC-B000-D15AAA93A3D5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_8:*:*:*:*:*:*",
"matchCriteriaId": "022132F8-6E56-4A29-95D6-3B7861D39CDF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_9:*:*:*:*:*:*",
"matchCriteriaId": "651DA9B7-9C11-47A7-AF5C-95625C8FFF6A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:-:*:*:*:*:*:*",
"matchCriteriaId": "8CAAE1B7-982E-4D50-9651-DEEE6CD74EED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_1:*:*:*:*:*:*",
"matchCriteriaId": "AFCF99EC-3384-418D-A419-B9DB607BE371",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_2:*:*:*:*:*:*",
"matchCriteriaId": "31E05134-A0C5-4937-A228-7D0884276B67",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_3:*:*:*:*:*:*",
"matchCriteriaId": "3F06C4AD-FD20-4345-8386-0895312F0A00",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_4:*:*:*:*:*:*",
"matchCriteriaId": "98CC25E2-EC3D-43A2-8D03-06F0E804EA63",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_5:*:*:*:*:*:*",
"matchCriteriaId": "30933C36-C710-488F-9601-EE1BB749C58A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_6:*:*:*:*:*:*",
"matchCriteriaId": "41E94372-A1AE-48B1-82DC-08B7B616473F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_7:*:*:*:*:*:*",
"matchCriteriaId": "51FBC8E0-34F8-475C-A1A8-571791CA05F9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_8:*:*:*:*:*:*",
"matchCriteriaId": "1E73EAEA-FA88-46B9-B9D5-A41603957AD7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_9:*:*:*:*:*:*",
"matchCriteriaId": "CF9BC654-4E3F-4B40-A6E5-79A818A51BED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.3:-:*:*:*:*:*:*",
"matchCriteriaId": "21C55D41-DB66-494D-BEEB-BDAC7CB4B31B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:*",
"matchCriteriaId": "38A0581E-BA9F-4B6D-AFEE-28AAA8CE31F6",
"versionEndIncluding": "7.3.5",
"versionStartIncluding": "7.2.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in the Asset module\u0027s Asset Publisher app in Liferay Portal 7.2.1 through 7.3.5, and Liferay DXP 7.1 before fix pack 21, 7.2 before fix pack 10 and 7.3 before fix pack 1 allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_XXXXXXXXXXXX_assetEntryId parameter."
},
{
"lang": "es",
"value": "Una vulnerabilidad de tipo cross-site scripting (XSS) en la aplicaci\u00f3n Asset Publisher del m\u00f3dulo Asset en Liferay Portal versiones 7.2.1 hasta 7.3.5, y Liferay DXP versiones 7.1 anteriores a fixpack 21, versiones 7.2 anteriores a fixpack 10 y versiones 7.3 anteriores a fixpack 1, permite a atacantes remotos inyectar un script web o HTML arbitrario por medio del par\u00e1metro _com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_XXXXXXXXXXXX_assetEntryId"
}
],
"id": "CVE-2021-29051",
"lastModified": "2024-11-21T06:00:36.163",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2021-05-17T12:15:07.460",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://liferay.com"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120743580"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://liferay.com"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120743580"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2022-09-22 01:15
Modified
2024-11-21 07:16
Severity ?
Summary
The Translation module in Liferay Portal v7.4.3.12 through v7.4.3.36, and Liferay DXP 7.4 update 8 through 36 does not check permissions before allowing a user to export a web content for translation, allowing attackers to download a web content page's XLIFF translation file via crafted URL.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | liferay_portal | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_10:*:*:*:*:*:*",
"matchCriteriaId": "3B8C3B3F-1BBB-47A5-A789-B207B6346FFF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_11:*:*:*:*:*:*",
"matchCriteriaId": "AD5D1171-954A-4E75-813D-E8392CFE4029",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_12:*:*:*:*:*:*",
"matchCriteriaId": "F148098A-D867-4C8B-9632-6B7F24D50C30",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_13:*:*:*:*:*:*",
"matchCriteriaId": "8A112ED2-27C2-45E3-8FA0-6043F7D3BEED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_14:*:*:*:*:*:*",
"matchCriteriaId": "0744AC04-9663-4DA1-9657-EC5BF0C68499",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_15:*:*:*:*:*:*",
"matchCriteriaId": "5703FE2B-011A-4A40-AB67-B989438F2183",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_16:*:*:*:*:*:*",
"matchCriteriaId": "41A54448-B1AB-4E92-8523-5D4A46A83533",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_17:*:*:*:*:*:*",
"matchCriteriaId": "A96A2A4A-3EB3-4074-A846-EC6EECC04B43",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_18:*:*:*:*:*:*",
"matchCriteriaId": "56DAE678-10B9-419D-9F5D-96E3AC3A6E4A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_19:*:*:*:*:*:*",
"matchCriteriaId": "064F4C28-B1F5-44C2-91AA-A09FD56EC0B9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_20:*:*:*:*:*:*",
"matchCriteriaId": "814D0CE3-B89F-423C-B1E3-47BD0A474491",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_21:*:*:*:*:*:*",
"matchCriteriaId": "58DB7C5A-B4E3-410A-B491-3F322B340BDF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_22:*:*:*:*:*:*",
"matchCriteriaId": "86B581B6-02B0-40B9-BB5C-E28FC51042DB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_23:*:*:*:*:*:*",
"matchCriteriaId": "E7EFBC14-6785-4435-BA96-D77A857BC1C8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_24:*:*:*:*:*:*",
"matchCriteriaId": "585635F8-53DC-4F64-BF6B-C6F72A5F4D29",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_25:*:*:*:*:*:*",
"matchCriteriaId": "355DD7FC-E9C7-43D6-8313-0474AB314F18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_26:*:*:*:*:*:*",
"matchCriteriaId": "B0FDE8B1-444A-4FEB-AC97-4B29C914EB8A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_27:*:*:*:*:*:*",
"matchCriteriaId": "683D063A-0E32-4E2D-8CBF-A57F45071F6E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_28:*:*:*:*:*:*",
"matchCriteriaId": "7DFEBCAB-1D9B-4BED-A2C6-11BA863F1EE9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_29:*:*:*:*:*:*",
"matchCriteriaId": "DB8733C4-8CE4-4E4B-A2AE-919AA69DAF8E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_3:*:*:*:*:*:*",
"matchCriteriaId": "25F5C3E9-CBB0-4114-91A4-41F0E666026A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_30:*:*:*:*:*:*",
"matchCriteriaId": "D372D9B9-5A83-4FF8-8DE5-617D99D1A8B5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_31:*:*:*:*:*:*",
"matchCriteriaId": "7519ABB1-57A7-46F1-97FC-DD44787F2B6E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_32:*:*:*:*:*:*",
"matchCriteriaId": "87BD916B-245C-4D62-B595-1985784C2ABC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_33:*:*:*:*:*:*",
"matchCriteriaId": "841E15A8-0819-4E48-B7E3-3ACCB4C1F43B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_34:*:*:*:*:*:*",
"matchCriteriaId": "91A243D9-7633-4836-B72D-75EF6C0F8876",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_35:*:*:*:*:*:*",
"matchCriteriaId": "6E2B1876-78B1-407A-9392-94FFF33AC803",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_36:*:*:*:*:*:*",
"matchCriteriaId": "4C6BBDC0-9D68-4653-9177-E49B847B04ED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_8:*:*:*:*:*:*",
"matchCriteriaId": "65693260-5B0F-47AA-BF08-D2979997A40A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_9:*:*:*:*:*:*",
"matchCriteriaId": "C9116909-04C3-4040-B945-4A6225425520",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:*",
"matchCriteriaId": "F8A78EE0-809C-4D58-9778-296ACB01C1EF",
"versionEndIncluding": "7.4.3.36",
"versionStartIncluding": "7.4.3.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The Translation module in Liferay Portal v7.4.3.12 through v7.4.3.36, and Liferay DXP 7.4 update 8 through 36 does not check permissions before allowing a user to export a web content for translation, allowing attackers to download a web content page\u0027s XLIFF translation file via crafted URL."
},
{
"lang": "es",
"value": "El m\u00f3dulo de traducci\u00f3n de Liferay Portal versiones v7.4.3.12 hasta v7.4.3.36, y Liferay DXP versiones 7.4 update 8 hasta 36, no comprueba los permisos antes de permitir a un usuario exportar un contenido web para su traducci\u00f3n, permitiendo a atacantes descargar el archivo de traducci\u00f3n XLIFF de una p\u00e1gina de contenido web por medio de una URL dise\u00f1ada"
}
],
"id": "CVE-2022-38512",
"lastModified": "2024-11-21T07:16:36.483",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2022-09-22T01:15:11.897",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Product"
],
"url": "http://liferay.com"
},
{
"source": "cve@mitre.org",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-38512"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Product"
],
"url": "http://liferay.com"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-38512"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-862"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2021-08-03 21:15
Modified
2024-11-21 06:08
Severity ?
Summary
The Portal Workflow module in Liferay Portal 7.3.2 and earlier, and Liferay DXP 7.0 before fix pack 93, 7.1 before fix pack 19 and 7.2 before fix pack 6, does not properly check user permission, which allows remote authenticated users to view and delete workflow submissions via crafted URLs.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | https://issues.liferay.com/browse/LPE-17032 | Patch, Vendor Advisory | |
| cve@mitre.org | https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120747742 | Release Notes, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://issues.liferay.com/browse/LPE-17032 | Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120747742 | Release Notes, Vendor Advisory |
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:-:*:*:*:*:*:*",
"matchCriteriaId": "43A92274-7D88-4F0F-8265-CF862011F27F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_13:*:*:*:*:*:*",
"matchCriteriaId": "4874012D-52AA-4C32-95E9-BD331225B4E6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_14:*:*:*:*:*:*",
"matchCriteriaId": "21CAF86F-CEC9-44EE-BAF8-0F7AF9D945F5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_24:*:*:*:*:*:*",
"matchCriteriaId": "EF6C9F29-EEFF-4737-BD50-58572D6C14E9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_25:*:*:*:*:*:*",
"matchCriteriaId": "D24E1FA0-BD94-4AFC-92BF-AEDEBC7DCF4B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_26:*:*:*:*:*:*",
"matchCriteriaId": "FF9B54EE-973B-44B4-8EA2-B58FA49AC561",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_27:*:*:*:*:*:*",
"matchCriteriaId": "A9637223-557D-474B-A46B-D276866376C3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_28:*:*:*:*:*:*",
"matchCriteriaId": "F6306F9C-99DE-4F94-8E7F-6747762BEC45",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_3\\+:*:*:*:*:*:*",
"matchCriteriaId": "2DFF08F0-77C1-43A0-B7DD-9B905BE074EB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_30:*:*:*:*:*:*",
"matchCriteriaId": "48B7015C-26B9-453E-B3CF-9B220D3A8024",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_33:*:*:*:*:*:*",
"matchCriteriaId": "0FEB6921-3C45-4B7E-8B34-CDC34984583D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_35:*:*:*:*:*:*",
"matchCriteriaId": "525F45DC-2E5C-46A8-AEDF-9D6B8FA2EB11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_36:*:*:*:*:*:*",
"matchCriteriaId": "55755D0C-4C0C-42D9-BE5E-5D33C8BA4C7F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_39:*:*:*:*:*:*",
"matchCriteriaId": "FB4FE0F9-EB19-45D7-A953-674629D951F5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_40:*:*:*:*:*:*",
"matchCriteriaId": "22E4B63F-01A9-4F85-92BC-A51F41BE4121",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_41:*:*:*:*:*:*",
"matchCriteriaId": "23BE441D-8770-4F4D-86CD-4E53161F54FB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_42:*:*:*:*:*:*",
"matchCriteriaId": "E14FF010-3907-4C79-B945-C792E446CB31",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_43:*:*:*:*:*:*",
"matchCriteriaId": "B97B5817-B55E-485D-9747-3A50CF7245C8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_44:*:*:*:*:*:*",
"matchCriteriaId": "19EBD671-56BD-45D3-9248-DAF3F47B36FD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_45:*:*:*:*:*:*",
"matchCriteriaId": "93EDC2A1-9622-44DB-ABA8-754D61B60787",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_46:*:*:*:*:*:*",
"matchCriteriaId": "B4B6A06D-C323-431C-9A65-4FD6A6E4CAB6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_47:*:*:*:*:*:*",
"matchCriteriaId": "EE6D4466-1C3A-4D5A-A65C-A30A87EADF1A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_48:*:*:*:*:*:*",
"matchCriteriaId": "4F0BC40A-8E13-4665-A2E4-F5815CA70E17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_49:*:*:*:*:*:*",
"matchCriteriaId": "11FB69C3-7755-495A-AB76-201AF4D9623B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_50:*:*:*:*:*:*",
"matchCriteriaId": "FF66F652-6C08-4D47-865D-36E70360B632",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_51:*:*:*:*:*:*",
"matchCriteriaId": "17B68D59-0509-4C6A-B803-03A02EB76F1F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_52:*:*:*:*:*:*",
"matchCriteriaId": "8F69B287-3B86-4B64-BCB4-40E9495A628D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_53:*:*:*:*:*:*",
"matchCriteriaId": "C627090E-A1BF-4332-9538-EE4E184DB65E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_54:*:*:*:*:*:*",
"matchCriteriaId": "9A089471-9944-4C75-A25F-1F23C18C0CF0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_56:*:*:*:*:*:*",
"matchCriteriaId": "B90E7FBF-6B5B-457A-8B20-ECA69A626BB8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_57:*:*:*:*:*:*",
"matchCriteriaId": "1975C1AB-EF50-42E2-9879-17FB763B45F9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_58:*:*:*:*:*:*",
"matchCriteriaId": "DFB7BB13-773B-47A6-A001-B9EBA46C917E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_59:*:*:*:*:*:*",
"matchCriteriaId": "1C4A2D39-3725-4E80-9F3F-AC1F4EE662E8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_60:*:*:*:*:*:*",
"matchCriteriaId": "BAEDF88B-B9C8-4891-B199-A72C066FC7BF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_61:*:*:*:*:*:*",
"matchCriteriaId": "F768E1DD-3DC6-4783-82DE-D089C7CD3C63",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_64:*:*:*:*:*:*",
"matchCriteriaId": "426EDA92-FE5A-4523-8AAE-1E5D5D67F535",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_65:*:*:*:*:*:*",
"matchCriteriaId": "070CB609-6D4B-4817-9F91-00BD62423E56",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_66:*:*:*:*:*:*",
"matchCriteriaId": "FEE87846-A4CF-47E5-93AA-5D7E2548D28D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_67:*:*:*:*:*:*",
"matchCriteriaId": "A4C11B0E-6D94-4A65-83BE-1E5828710CB9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_68:*:*:*:*:*:*",
"matchCriteriaId": "F1DC73B1-4017-424F-A28D-F54F2FA8ED8C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_69:*:*:*:*:*:*",
"matchCriteriaId": "32B4FD3C-7BB7-4DA2-9A3A-05A6370B9745",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_70:*:*:*:*:*:*",
"matchCriteriaId": "71293E5B-4DCC-47BC-A493-3540D57E6067",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_71:*:*:*:*:*:*",
"matchCriteriaId": "56A8940B-318E-4C6A-9131-A50E90E82C28",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_72:*:*:*:*:*:*",
"matchCriteriaId": "F09B5E82-DC18-4B07-9A05-E433579B4FB5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_73:*:*:*:*:*:*",
"matchCriteriaId": "CE25D189-2D6F-4229-BF09-2CEA0A6C5D50",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_75:*:*:*:*:*:*",
"matchCriteriaId": "36549BE5-DEDB-408A-BFC9-AB00031D45DD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_76:*:*:*:*:*:*",
"matchCriteriaId": "E11B8075-4212-41CB-85AC-09FA1CDB86A1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_78:*:*:*:*:*:*",
"matchCriteriaId": "80412DCE-D79F-492A-8788-6A43C4D76D7C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_79:*:*:*:*:*:*",
"matchCriteriaId": "BC7A939F-21D1-4AF1-BAB9-E91DFCFFB7A2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_80:*:*:*:*:*:*",
"matchCriteriaId": "5F2240FC-EDDC-47F5-B713-07FF2D23CE00",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_81:*:*:*:*:*:*",
"matchCriteriaId": "5006AAE4-B154-468A-850C-20171965E2AC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_82:*:*:*:*:*:*",
"matchCriteriaId": "1541072D-3F14-47A2-8A42-EF2765643AE4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_83:*:*:*:*:*:*",
"matchCriteriaId": "2340C85F-0296-4591-8D23-56634C50C5F8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_84:*:*:*:*:*:*",
"matchCriteriaId": "6BEC3C5C-DA8C-4620-A38E-BB47D4CB7CBA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_85:*:*:*:*:*:*",
"matchCriteriaId": "6DD38B1F-7EEA-4DB5-A31B-D84DC33313FA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_86:*:*:*:*:*:*",
"matchCriteriaId": "FC923A9E-CF9D-44DE-AB58-7BCAAFDDE7D6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_87:*:*:*:*:*:*",
"matchCriteriaId": "65542031-04E1-485F-8102-04CB65865ECE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_88:*:*:*:*:*:*",
"matchCriteriaId": "B36F2FBD-E949-4608-9ECF-0F05DD8E487E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_89:*:*:*:*:*:*",
"matchCriteriaId": "D68832F1-6D71-4A63-AA8A-86C0EDF9F8E1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_90:*:*:*:*:*:*",
"matchCriteriaId": "FD1F579A-084C-46A9-ADCA-8F3FA45D85D6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_91:*:*:*:*:*:*",
"matchCriteriaId": "FC81C494-F68E-4580-87FB-7792C1080DFC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_92:*:*:*:*:*:*",
"matchCriteriaId": "6693594D-6731-4223-8C28-4873746B97AB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:-:*:*:*:*:*:*",
"matchCriteriaId": "C2AA7E18-A41B-4F0D-A04F-57C5745D091B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_1:*:*:*:*:*:*",
"matchCriteriaId": "392B783D-620D-4C71-AAA0-848B16964A27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_10:*:*:*:*:*:*",
"matchCriteriaId": "4F5A94E2-22B7-4D2D-A491-29F395E727C5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_11:*:*:*:*:*:*",
"matchCriteriaId": "E9B10908-C42B-4763-9D47-236506B0E84A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_12:*:*:*:*:*:*",
"matchCriteriaId": "CF544435-36AC-49B8-BA50-A6B6D1678BBC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_13:*:*:*:*:*:*",
"matchCriteriaId": "9D265542-5333-4CCD-90E5-B5F6A55F9863",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_14:*:*:*:*:*:*",
"matchCriteriaId": "1763CD8B-3ACD-4617-A1CA-B9F77A074977",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_15:*:*:*:*:*:*",
"matchCriteriaId": "F25C66AA-B60D-413C-A848-51E12D6080AC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_16:*:*:*:*:*:*",
"matchCriteriaId": "071A0D53-EC95-4B18-9FA3-55208B1F7B94",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_17:*:*:*:*:*:*",
"matchCriteriaId": "CC26A9D4-14D6-46B1-BB00-A2C4386EBCA4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_18:*:*:*:*:*:*",
"matchCriteriaId": "350CDEDA-9A20-4BC3-BEAE-8346CED10CD6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_2:*:*:*:*:*:*",
"matchCriteriaId": "3233D306-3F8E-40A4-B132-7264E63DD131",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_3:*:*:*:*:*:*",
"matchCriteriaId": "9EAEA45A-0370-475E-B4CB-395A434DC3A1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_4:*:*:*:*:*:*",
"matchCriteriaId": "39310F05-1DB6-43BA-811C-9CB91D6DCF20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_5:*:*:*:*:*:*",
"matchCriteriaId": "D6135B16-C89E-4F49-BA15-823E2AF26D68",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_6:*:*:*:*:*:*",
"matchCriteriaId": "CC887BEC-915B-44AC-B473-5448B3D8DCF7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_7:*:*:*:*:*:*",
"matchCriteriaId": "D7A7CC60-C294-41EC-B000-D15AAA93A3D5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_8:*:*:*:*:*:*",
"matchCriteriaId": "022132F8-6E56-4A29-95D6-3B7861D39CDF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_9:*:*:*:*:*:*",
"matchCriteriaId": "651DA9B7-9C11-47A7-AF5C-95625C8FFF6A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:-:*:*:*:*:*:*",
"matchCriteriaId": "8CAAE1B7-982E-4D50-9651-DEEE6CD74EED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_1:*:*:*:*:*:*",
"matchCriteriaId": "AFCF99EC-3384-418D-A419-B9DB607BE371",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_2:*:*:*:*:*:*",
"matchCriteriaId": "31E05134-A0C5-4937-A228-7D0884276B67",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_3:*:*:*:*:*:*",
"matchCriteriaId": "3F06C4AD-FD20-4345-8386-0895312F0A00",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_4:*:*:*:*:*:*",
"matchCriteriaId": "98CC25E2-EC3D-43A2-8D03-06F0E804EA63",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_5:*:*:*:*:*:*",
"matchCriteriaId": "30933C36-C710-488F-9601-EE1BB749C58A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:*",
"matchCriteriaId": "94896449-7A52-40D2-8E76-26DC60D7BA9A",
"versionEndExcluding": "7.3.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The Portal Workflow module in Liferay Portal 7.3.2 and earlier, and Liferay DXP 7.0 before fix pack 93, 7.1 before fix pack 19 and 7.2 before fix pack 6, does not properly check user permission, which allows remote authenticated users to view and delete workflow submissions via crafted URLs."
},
{
"lang": "es",
"value": "El m\u00f3dulo Portal Workflow en Liferay Portal versiones 7.3.2 y anteriores, y Liferay DXP versiones 7.0 anteriores a fix pack 93, versiones 7.1 anteriores a fix pack 19 y versiones 7.2 anteriores a fix pack 6, no comprueba apropiadamente los permisos de usuario, que permite a usuarios autenticados remotos visualizar y eliminar env\u00edos de flujos de trabajo por medio de URLs dise\u00f1adas"
}
],
"id": "CVE-2021-33333",
"lastModified": "2024-11-21T06:08:42.770",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 8.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 3.4,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2021-08-03T21:15:08.573",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://issues.liferay.com/browse/LPE-17032"
},
{
"source": "cve@mitre.org",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120747742"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://issues.liferay.com/browse/LPE-17032"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120747742"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-276"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2020-09-24 15:15
Modified
2024-11-21 05:06
Severity ?
Summary
In Liferay Portal before 7.3.1, Liferay Portal 6.2 EE, and Liferay DXP 7.2, DXP 7.1 and DXP 7.0, the property 'portlet.resource.id.banned.paths.regexp' can be bypassed with doubled encoded URLs.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| liferay | dxp | 7.0 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.2 | |
| liferay | liferay_portal | * | |
| liferay | liferay_portal | 6.2 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "726967CC-1BE0-48AB-8BD1-BE4B09ADFD36",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:*:*:*:*:*:*:*",
"matchCriteriaId": "980981E7-41E3-4F67-A90C-4460BE4CA62A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:*:*:*:*:*:*:*",
"matchCriteriaId": "597580A0-6E74-41D5-9242-9187AF618AD8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:*",
"matchCriteriaId": "73CDC2CC-EE82-4010-88E5-EDC175DA4D47",
"versionEndExcluding": "7.3.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:liferay_portal:6.2:-:*:*:enterprise:*:*:*",
"matchCriteriaId": "45888C16-DD71-4704-8DBF-BEAF9778DFDA",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In Liferay Portal before 7.3.1, Liferay Portal 6.2 EE, and Liferay DXP 7.2, DXP 7.1 and DXP 7.0, the property \u0027portlet.resource.id.banned.paths.regexp\u0027 can be bypassed with doubled encoded URLs."
},
{
"lang": "es",
"value": "En Liferay Portal versiones anteriores a 7.3.1, Liferay Portal versi\u00f3n 6.2 EE y Liferay DXP versi\u00f3n 7.2, DXP ??versi\u00f3n 7.1 y DXP versi\u00f3n 7.0, la propiedad \"portlet.resource.id.banned.paths.regexp\" puede ser omitida con unas URL codificadas duplicadas."
}
],
"id": "CVE-2020-15840",
"lastModified": "2024-11-21T05:06:17.767",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 1.4,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2020-09-24T15:15:14.080",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Issue Tracking",
"Vendor Advisory"
],
"url": "https://issues.liferay.com/browse/LPE-17046"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/119772204"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Issue Tracking",
"Vendor Advisory"
],
"url": "https://issues.liferay.com/browse/LPE-17046"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/119772204"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-noinfo"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2021-08-03 19:15
Modified
2024-11-21 06:08
Severity ?
Summary
Cross-site scripting (XSS) vulnerability in the Frontend JS module in Liferay Portal 7.3.4 and earlier, and Liferay DXP 7.0 before fix pack 96, 7.1 before fix pack 20 and 7.2 before fix pack 9, allows remote attackers to inject arbitrary web script or HTML via the title of a modal window.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | https://issues.liferay.com/browse/LPE-17093 | Patch, Vendor Advisory | |
| cve@mitre.org | https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120747869 | Release Notes, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://issues.liferay.com/browse/LPE-17093 | Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120747869 | Release Notes, Vendor Advisory |
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:-:*:*:*:*:*:*",
"matchCriteriaId": "43A92274-7D88-4F0F-8265-CF862011F27F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_13:*:*:*:*:*:*",
"matchCriteriaId": "4874012D-52AA-4C32-95E9-BD331225B4E6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_14:*:*:*:*:*:*",
"matchCriteriaId": "21CAF86F-CEC9-44EE-BAF8-0F7AF9D945F5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_24:*:*:*:*:*:*",
"matchCriteriaId": "EF6C9F29-EEFF-4737-BD50-58572D6C14E9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_25:*:*:*:*:*:*",
"matchCriteriaId": "D24E1FA0-BD94-4AFC-92BF-AEDEBC7DCF4B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_26:*:*:*:*:*:*",
"matchCriteriaId": "FF9B54EE-973B-44B4-8EA2-B58FA49AC561",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_27:*:*:*:*:*:*",
"matchCriteriaId": "A9637223-557D-474B-A46B-D276866376C3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_28:*:*:*:*:*:*",
"matchCriteriaId": "F6306F9C-99DE-4F94-8E7F-6747762BEC45",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_3\\+:*:*:*:*:*:*",
"matchCriteriaId": "2DFF08F0-77C1-43A0-B7DD-9B905BE074EB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_30:*:*:*:*:*:*",
"matchCriteriaId": "48B7015C-26B9-453E-B3CF-9B220D3A8024",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_33:*:*:*:*:*:*",
"matchCriteriaId": "0FEB6921-3C45-4B7E-8B34-CDC34984583D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_35:*:*:*:*:*:*",
"matchCriteriaId": "525F45DC-2E5C-46A8-AEDF-9D6B8FA2EB11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_36:*:*:*:*:*:*",
"matchCriteriaId": "55755D0C-4C0C-42D9-BE5E-5D33C8BA4C7F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_39:*:*:*:*:*:*",
"matchCriteriaId": "FB4FE0F9-EB19-45D7-A953-674629D951F5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_40:*:*:*:*:*:*",
"matchCriteriaId": "22E4B63F-01A9-4F85-92BC-A51F41BE4121",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_41:*:*:*:*:*:*",
"matchCriteriaId": "23BE441D-8770-4F4D-86CD-4E53161F54FB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_42:*:*:*:*:*:*",
"matchCriteriaId": "E14FF010-3907-4C79-B945-C792E446CB31",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_43:*:*:*:*:*:*",
"matchCriteriaId": "B97B5817-B55E-485D-9747-3A50CF7245C8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_44:*:*:*:*:*:*",
"matchCriteriaId": "19EBD671-56BD-45D3-9248-DAF3F47B36FD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_45:*:*:*:*:*:*",
"matchCriteriaId": "93EDC2A1-9622-44DB-ABA8-754D61B60787",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_46:*:*:*:*:*:*",
"matchCriteriaId": "B4B6A06D-C323-431C-9A65-4FD6A6E4CAB6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_47:*:*:*:*:*:*",
"matchCriteriaId": "EE6D4466-1C3A-4D5A-A65C-A30A87EADF1A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_48:*:*:*:*:*:*",
"matchCriteriaId": "4F0BC40A-8E13-4665-A2E4-F5815CA70E17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_49:*:*:*:*:*:*",
"matchCriteriaId": "11FB69C3-7755-495A-AB76-201AF4D9623B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_50:*:*:*:*:*:*",
"matchCriteriaId": "FF66F652-6C08-4D47-865D-36E70360B632",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_51:*:*:*:*:*:*",
"matchCriteriaId": "17B68D59-0509-4C6A-B803-03A02EB76F1F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_52:*:*:*:*:*:*",
"matchCriteriaId": "8F69B287-3B86-4B64-BCB4-40E9495A628D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_53:*:*:*:*:*:*",
"matchCriteriaId": "C627090E-A1BF-4332-9538-EE4E184DB65E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_54:*:*:*:*:*:*",
"matchCriteriaId": "9A089471-9944-4C75-A25F-1F23C18C0CF0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_56:*:*:*:*:*:*",
"matchCriteriaId": "B90E7FBF-6B5B-457A-8B20-ECA69A626BB8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_57:*:*:*:*:*:*",
"matchCriteriaId": "1975C1AB-EF50-42E2-9879-17FB763B45F9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_58:*:*:*:*:*:*",
"matchCriteriaId": "DFB7BB13-773B-47A6-A001-B9EBA46C917E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_59:*:*:*:*:*:*",
"matchCriteriaId": "1C4A2D39-3725-4E80-9F3F-AC1F4EE662E8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_60:*:*:*:*:*:*",
"matchCriteriaId": "BAEDF88B-B9C8-4891-B199-A72C066FC7BF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_61:*:*:*:*:*:*",
"matchCriteriaId": "F768E1DD-3DC6-4783-82DE-D089C7CD3C63",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_64:*:*:*:*:*:*",
"matchCriteriaId": "426EDA92-FE5A-4523-8AAE-1E5D5D67F535",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_65:*:*:*:*:*:*",
"matchCriteriaId": "070CB609-6D4B-4817-9F91-00BD62423E56",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_66:*:*:*:*:*:*",
"matchCriteriaId": "FEE87846-A4CF-47E5-93AA-5D7E2548D28D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_67:*:*:*:*:*:*",
"matchCriteriaId": "A4C11B0E-6D94-4A65-83BE-1E5828710CB9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_68:*:*:*:*:*:*",
"matchCriteriaId": "F1DC73B1-4017-424F-A28D-F54F2FA8ED8C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_69:*:*:*:*:*:*",
"matchCriteriaId": "32B4FD3C-7BB7-4DA2-9A3A-05A6370B9745",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_70:*:*:*:*:*:*",
"matchCriteriaId": "71293E5B-4DCC-47BC-A493-3540D57E6067",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_71:*:*:*:*:*:*",
"matchCriteriaId": "56A8940B-318E-4C6A-9131-A50E90E82C28",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_72:*:*:*:*:*:*",
"matchCriteriaId": "F09B5E82-DC18-4B07-9A05-E433579B4FB5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_73:*:*:*:*:*:*",
"matchCriteriaId": "CE25D189-2D6F-4229-BF09-2CEA0A6C5D50",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_75:*:*:*:*:*:*",
"matchCriteriaId": "36549BE5-DEDB-408A-BFC9-AB00031D45DD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_76:*:*:*:*:*:*",
"matchCriteriaId": "E11B8075-4212-41CB-85AC-09FA1CDB86A1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_78:*:*:*:*:*:*",
"matchCriteriaId": "80412DCE-D79F-492A-8788-6A43C4D76D7C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_79:*:*:*:*:*:*",
"matchCriteriaId": "BC7A939F-21D1-4AF1-BAB9-E91DFCFFB7A2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_80:*:*:*:*:*:*",
"matchCriteriaId": "5F2240FC-EDDC-47F5-B713-07FF2D23CE00",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_81:*:*:*:*:*:*",
"matchCriteriaId": "5006AAE4-B154-468A-850C-20171965E2AC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_82:*:*:*:*:*:*",
"matchCriteriaId": "1541072D-3F14-47A2-8A42-EF2765643AE4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_83:*:*:*:*:*:*",
"matchCriteriaId": "2340C85F-0296-4591-8D23-56634C50C5F8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_84:*:*:*:*:*:*",
"matchCriteriaId": "6BEC3C5C-DA8C-4620-A38E-BB47D4CB7CBA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_85:*:*:*:*:*:*",
"matchCriteriaId": "6DD38B1F-7EEA-4DB5-A31B-D84DC33313FA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_86:*:*:*:*:*:*",
"matchCriteriaId": "FC923A9E-CF9D-44DE-AB58-7BCAAFDDE7D6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_87:*:*:*:*:*:*",
"matchCriteriaId": "65542031-04E1-485F-8102-04CB65865ECE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_88:*:*:*:*:*:*",
"matchCriteriaId": "B36F2FBD-E949-4608-9ECF-0F05DD8E487E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_89:*:*:*:*:*:*",
"matchCriteriaId": "D68832F1-6D71-4A63-AA8A-86C0EDF9F8E1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_90:*:*:*:*:*:*",
"matchCriteriaId": "FD1F579A-084C-46A9-ADCA-8F3FA45D85D6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_91:*:*:*:*:*:*",
"matchCriteriaId": "FC81C494-F68E-4580-87FB-7792C1080DFC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_92:*:*:*:*:*:*",
"matchCriteriaId": "6693594D-6731-4223-8C28-4873746B97AB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_93:*:*:*:*:*:*",
"matchCriteriaId": "0B96CDC5-F4DE-49A2-B09D-318163EC9A09",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_94:*:*:*:*:*:*",
"matchCriteriaId": "EEAE13AF-DEEE-4284-A93D-EFE2647E12FB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_95:*:*:*:*:*:*",
"matchCriteriaId": "9EEADDC3-C436-452F-9271-8F30A9D03FE6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:-:*:*:*:*:*:*",
"matchCriteriaId": "C2AA7E18-A41B-4F0D-A04F-57C5745D091B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_1:*:*:*:*:*:*",
"matchCriteriaId": "392B783D-620D-4C71-AAA0-848B16964A27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_10:*:*:*:*:*:*",
"matchCriteriaId": "4F5A94E2-22B7-4D2D-A491-29F395E727C5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_11:*:*:*:*:*:*",
"matchCriteriaId": "E9B10908-C42B-4763-9D47-236506B0E84A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_12:*:*:*:*:*:*",
"matchCriteriaId": "CF544435-36AC-49B8-BA50-A6B6D1678BBC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_13:*:*:*:*:*:*",
"matchCriteriaId": "9D265542-5333-4CCD-90E5-B5F6A55F9863",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_14:*:*:*:*:*:*",
"matchCriteriaId": "1763CD8B-3ACD-4617-A1CA-B9F77A074977",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_15:*:*:*:*:*:*",
"matchCriteriaId": "F25C66AA-B60D-413C-A848-51E12D6080AC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_16:*:*:*:*:*:*",
"matchCriteriaId": "071A0D53-EC95-4B18-9FA3-55208B1F7B94",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_17:*:*:*:*:*:*",
"matchCriteriaId": "CC26A9D4-14D6-46B1-BB00-A2C4386EBCA4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_18:*:*:*:*:*:*",
"matchCriteriaId": "350CDEDA-9A20-4BC3-BEAE-8346CED10CD6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_19:*:*:*:*:*:*",
"matchCriteriaId": "10C6107E-79B3-4672-B3E5-8A2FA9A829CF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_2:*:*:*:*:*:*",
"matchCriteriaId": "3233D306-3F8E-40A4-B132-7264E63DD131",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_3:*:*:*:*:*:*",
"matchCriteriaId": "9EAEA45A-0370-475E-B4CB-395A434DC3A1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_4:*:*:*:*:*:*",
"matchCriteriaId": "39310F05-1DB6-43BA-811C-9CB91D6DCF20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_5:*:*:*:*:*:*",
"matchCriteriaId": "D6135B16-C89E-4F49-BA15-823E2AF26D68",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_6:*:*:*:*:*:*",
"matchCriteriaId": "CC887BEC-915B-44AC-B473-5448B3D8DCF7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_7:*:*:*:*:*:*",
"matchCriteriaId": "D7A7CC60-C294-41EC-B000-D15AAA93A3D5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_8:*:*:*:*:*:*",
"matchCriteriaId": "022132F8-6E56-4A29-95D6-3B7861D39CDF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_9:*:*:*:*:*:*",
"matchCriteriaId": "651DA9B7-9C11-47A7-AF5C-95625C8FFF6A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:-:*:*:*:*:*:*",
"matchCriteriaId": "8CAAE1B7-982E-4D50-9651-DEEE6CD74EED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_1:*:*:*:*:*:*",
"matchCriteriaId": "AFCF99EC-3384-418D-A419-B9DB607BE371",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_2:*:*:*:*:*:*",
"matchCriteriaId": "31E05134-A0C5-4937-A228-7D0884276B67",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_3:*:*:*:*:*:*",
"matchCriteriaId": "3F06C4AD-FD20-4345-8386-0895312F0A00",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_4:*:*:*:*:*:*",
"matchCriteriaId": "98CC25E2-EC3D-43A2-8D03-06F0E804EA63",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_5:*:*:*:*:*:*",
"matchCriteriaId": "30933C36-C710-488F-9601-EE1BB749C58A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_6:*:*:*:*:*:*",
"matchCriteriaId": "41E94372-A1AE-48B1-82DC-08B7B616473F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_7:*:*:*:*:*:*",
"matchCriteriaId": "51FBC8E0-34F8-475C-A1A8-571791CA05F9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_8:*:*:*:*:*:*",
"matchCriteriaId": "1E73EAEA-FA88-46B9-B9D5-A41603957AD7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:*",
"matchCriteriaId": "101E130F-36D3-4775-8AD9-AA289E581CDB",
"versionEndExcluding": "7.3.5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in the Frontend JS module in Liferay Portal 7.3.4 and earlier, and Liferay DXP 7.0 before fix pack 96, 7.1 before fix pack 20 and 7.2 before fix pack 9, allows remote attackers to inject arbitrary web script or HTML via the title of a modal window."
},
{
"lang": "es",
"value": "Una vulnerabilidad de tipo Cross-site scripting (XSS) en el m\u00f3dulo Frontend JS de Liferay Portal versiones 7.3.4 y anteriores, y Liferay DXP versiones 7.0 anterior a fix pack 96, versiones 7.1 anterior a fix pack 20 y versiones 7.2 anterior a fix pack 9, permite a atacantes remotos inyectar script web o HTML arbitrario por medio del t\u00edtulo de una ventana modal"
}
],
"id": "CVE-2021-33326",
"lastModified": "2024-11-21T06:08:41.810",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2021-08-03T19:15:08.757",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://issues.liferay.com/browse/LPE-17093"
},
{
"source": "cve@mitre.org",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120747869"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://issues.liferay.com/browse/LPE-17093"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120747869"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2021-05-17 12:15
Modified
2024-11-21 06:00
Severity ?
Summary
The Data Engine module in Liferay Portal 7.3.0 through 7.3.5, and Liferay DXP 7.3 before fix pack 1 does not check permissions in DataDefinitionResourceImpl.getSiteDataDefinitionByContentTypeByDataDefinitionKey, which allows remote authenticated users to view DDMStructures via GET API calls.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| liferay | dxp | 7.3 | |
| liferay | liferay_portal | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:liferay:dxp:7.3:-:*:*:*:*:*:*",
"matchCriteriaId": "21C55D41-DB66-494D-BEEB-BDAC7CB4B31B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:*",
"matchCriteriaId": "FF368A19-1F80-4A53-82C8-DDF6895F9992",
"versionEndIncluding": "7.3.5",
"versionStartIncluding": "7.3.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The Data Engine module in Liferay Portal 7.3.0 through 7.3.5, and Liferay DXP 7.3 before fix pack 1 does not check permissions in DataDefinitionResourceImpl.getSiteDataDefinitionByContentTypeByDataDefinitionKey, which allows remote authenticated users to view DDMStructures via GET API calls."
},
{
"lang": "es",
"value": "El m\u00f3dulo Data Engine en Liferay Portal versiones 7.3.0 hasta 7.3.5 y Liferay DXP versiones 7.3 anteriores a fixpack 1 no comprueba los permisos en DataDefinitionResourceImpl.getSiteDataDefinitionByContentTypeByDataDefinitionKey, que permite a los usuarios autenticados remotos visualizar estructuras DDMS por medio de llamadas a la API GET"
}
],
"id": "CVE-2021-29052",
"lastModified": "2024-11-21T06:00:36.323",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 4.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 1.4,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2021-05-17T12:15:07.490",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://liferay.com"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120743159"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://liferay.com"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120743159"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-276"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2021-08-03 19:15
Modified
2024-11-21 06:08
Severity ?
Summary
Cross-site scripting (XSS) vulnerability in the Asset module's edit vocabulary page in Liferay Portal 7.0.0 through 7.3.4, and Liferay DXP 7.0 before fix pack 96, 7.1 before fix pack 20, and 7.2 before fix pack 9, allows remote attackers to inject arbitrary web script or HTML via the (1) _com_liferay_journal_web_portlet_JournalPortlet_name or (2) _com_liferay_document_library_web_portlet_DLAdminPortlet_name parameter.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | https://issues.liferay.com/browse/LPE-17100 | Patch, Vendor Advisory | |
| cve@mitre.org | https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120747972 | Release Notes, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://issues.liferay.com/browse/LPE-17100 | Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120747972 | Release Notes, Vendor Advisory |
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:-:*:*:*:*:*:*",
"matchCriteriaId": "43A92274-7D88-4F0F-8265-CF862011F27F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_13:*:*:*:*:*:*",
"matchCriteriaId": "4874012D-52AA-4C32-95E9-BD331225B4E6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_14:*:*:*:*:*:*",
"matchCriteriaId": "21CAF86F-CEC9-44EE-BAF8-0F7AF9D945F5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_24:*:*:*:*:*:*",
"matchCriteriaId": "EF6C9F29-EEFF-4737-BD50-58572D6C14E9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_25:*:*:*:*:*:*",
"matchCriteriaId": "D24E1FA0-BD94-4AFC-92BF-AEDEBC7DCF4B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_26:*:*:*:*:*:*",
"matchCriteriaId": "FF9B54EE-973B-44B4-8EA2-B58FA49AC561",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_27:*:*:*:*:*:*",
"matchCriteriaId": "A9637223-557D-474B-A46B-D276866376C3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_28:*:*:*:*:*:*",
"matchCriteriaId": "F6306F9C-99DE-4F94-8E7F-6747762BEC45",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_3\\+:*:*:*:*:*:*",
"matchCriteriaId": "2DFF08F0-77C1-43A0-B7DD-9B905BE074EB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_30:*:*:*:*:*:*",
"matchCriteriaId": "48B7015C-26B9-453E-B3CF-9B220D3A8024",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_33:*:*:*:*:*:*",
"matchCriteriaId": "0FEB6921-3C45-4B7E-8B34-CDC34984583D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_35:*:*:*:*:*:*",
"matchCriteriaId": "525F45DC-2E5C-46A8-AEDF-9D6B8FA2EB11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_36:*:*:*:*:*:*",
"matchCriteriaId": "55755D0C-4C0C-42D9-BE5E-5D33C8BA4C7F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_39:*:*:*:*:*:*",
"matchCriteriaId": "FB4FE0F9-EB19-45D7-A953-674629D951F5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_40:*:*:*:*:*:*",
"matchCriteriaId": "22E4B63F-01A9-4F85-92BC-A51F41BE4121",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_41:*:*:*:*:*:*",
"matchCriteriaId": "23BE441D-8770-4F4D-86CD-4E53161F54FB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_42:*:*:*:*:*:*",
"matchCriteriaId": "E14FF010-3907-4C79-B945-C792E446CB31",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_43:*:*:*:*:*:*",
"matchCriteriaId": "B97B5817-B55E-485D-9747-3A50CF7245C8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_44:*:*:*:*:*:*",
"matchCriteriaId": "19EBD671-56BD-45D3-9248-DAF3F47B36FD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_45:*:*:*:*:*:*",
"matchCriteriaId": "93EDC2A1-9622-44DB-ABA8-754D61B60787",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_46:*:*:*:*:*:*",
"matchCriteriaId": "B4B6A06D-C323-431C-9A65-4FD6A6E4CAB6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_47:*:*:*:*:*:*",
"matchCriteriaId": "EE6D4466-1C3A-4D5A-A65C-A30A87EADF1A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_48:*:*:*:*:*:*",
"matchCriteriaId": "4F0BC40A-8E13-4665-A2E4-F5815CA70E17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_49:*:*:*:*:*:*",
"matchCriteriaId": "11FB69C3-7755-495A-AB76-201AF4D9623B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_50:*:*:*:*:*:*",
"matchCriteriaId": "FF66F652-6C08-4D47-865D-36E70360B632",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_51:*:*:*:*:*:*",
"matchCriteriaId": "17B68D59-0509-4C6A-B803-03A02EB76F1F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_52:*:*:*:*:*:*",
"matchCriteriaId": "8F69B287-3B86-4B64-BCB4-40E9495A628D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_53:*:*:*:*:*:*",
"matchCriteriaId": "C627090E-A1BF-4332-9538-EE4E184DB65E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_54:*:*:*:*:*:*",
"matchCriteriaId": "9A089471-9944-4C75-A25F-1F23C18C0CF0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_56:*:*:*:*:*:*",
"matchCriteriaId": "B90E7FBF-6B5B-457A-8B20-ECA69A626BB8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_57:*:*:*:*:*:*",
"matchCriteriaId": "1975C1AB-EF50-42E2-9879-17FB763B45F9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_58:*:*:*:*:*:*",
"matchCriteriaId": "DFB7BB13-773B-47A6-A001-B9EBA46C917E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_59:*:*:*:*:*:*",
"matchCriteriaId": "1C4A2D39-3725-4E80-9F3F-AC1F4EE662E8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_60:*:*:*:*:*:*",
"matchCriteriaId": "BAEDF88B-B9C8-4891-B199-A72C066FC7BF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_61:*:*:*:*:*:*",
"matchCriteriaId": "F768E1DD-3DC6-4783-82DE-D089C7CD3C63",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_64:*:*:*:*:*:*",
"matchCriteriaId": "426EDA92-FE5A-4523-8AAE-1E5D5D67F535",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_65:*:*:*:*:*:*",
"matchCriteriaId": "070CB609-6D4B-4817-9F91-00BD62423E56",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_66:*:*:*:*:*:*",
"matchCriteriaId": "FEE87846-A4CF-47E5-93AA-5D7E2548D28D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_67:*:*:*:*:*:*",
"matchCriteriaId": "A4C11B0E-6D94-4A65-83BE-1E5828710CB9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_68:*:*:*:*:*:*",
"matchCriteriaId": "F1DC73B1-4017-424F-A28D-F54F2FA8ED8C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_69:*:*:*:*:*:*",
"matchCriteriaId": "32B4FD3C-7BB7-4DA2-9A3A-05A6370B9745",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_70:*:*:*:*:*:*",
"matchCriteriaId": "71293E5B-4DCC-47BC-A493-3540D57E6067",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_71:*:*:*:*:*:*",
"matchCriteriaId": "56A8940B-318E-4C6A-9131-A50E90E82C28",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_72:*:*:*:*:*:*",
"matchCriteriaId": "F09B5E82-DC18-4B07-9A05-E433579B4FB5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_73:*:*:*:*:*:*",
"matchCriteriaId": "CE25D189-2D6F-4229-BF09-2CEA0A6C5D50",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_75:*:*:*:*:*:*",
"matchCriteriaId": "36549BE5-DEDB-408A-BFC9-AB00031D45DD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_76:*:*:*:*:*:*",
"matchCriteriaId": "E11B8075-4212-41CB-85AC-09FA1CDB86A1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_78:*:*:*:*:*:*",
"matchCriteriaId": "80412DCE-D79F-492A-8788-6A43C4D76D7C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_79:*:*:*:*:*:*",
"matchCriteriaId": "BC7A939F-21D1-4AF1-BAB9-E91DFCFFB7A2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_80:*:*:*:*:*:*",
"matchCriteriaId": "5F2240FC-EDDC-47F5-B713-07FF2D23CE00",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_81:*:*:*:*:*:*",
"matchCriteriaId": "5006AAE4-B154-468A-850C-20171965E2AC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_82:*:*:*:*:*:*",
"matchCriteriaId": "1541072D-3F14-47A2-8A42-EF2765643AE4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_83:*:*:*:*:*:*",
"matchCriteriaId": "2340C85F-0296-4591-8D23-56634C50C5F8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_84:*:*:*:*:*:*",
"matchCriteriaId": "6BEC3C5C-DA8C-4620-A38E-BB47D4CB7CBA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_85:*:*:*:*:*:*",
"matchCriteriaId": "6DD38B1F-7EEA-4DB5-A31B-D84DC33313FA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_86:*:*:*:*:*:*",
"matchCriteriaId": "FC923A9E-CF9D-44DE-AB58-7BCAAFDDE7D6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_87:*:*:*:*:*:*",
"matchCriteriaId": "65542031-04E1-485F-8102-04CB65865ECE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_88:*:*:*:*:*:*",
"matchCriteriaId": "B36F2FBD-E949-4608-9ECF-0F05DD8E487E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_89:*:*:*:*:*:*",
"matchCriteriaId": "D68832F1-6D71-4A63-AA8A-86C0EDF9F8E1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_90:*:*:*:*:*:*",
"matchCriteriaId": "FD1F579A-084C-46A9-ADCA-8F3FA45D85D6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_91:*:*:*:*:*:*",
"matchCriteriaId": "FC81C494-F68E-4580-87FB-7792C1080DFC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_92:*:*:*:*:*:*",
"matchCriteriaId": "6693594D-6731-4223-8C28-4873746B97AB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_93:*:*:*:*:*:*",
"matchCriteriaId": "0B96CDC5-F4DE-49A2-B09D-318163EC9A09",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_94:*:*:*:*:*:*",
"matchCriteriaId": "EEAE13AF-DEEE-4284-A93D-EFE2647E12FB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_95:*:*:*:*:*:*",
"matchCriteriaId": "9EEADDC3-C436-452F-9271-8F30A9D03FE6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:-:*:*:*:*:*:*",
"matchCriteriaId": "C2AA7E18-A41B-4F0D-A04F-57C5745D091B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_1:*:*:*:*:*:*",
"matchCriteriaId": "392B783D-620D-4C71-AAA0-848B16964A27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_10:*:*:*:*:*:*",
"matchCriteriaId": "4F5A94E2-22B7-4D2D-A491-29F395E727C5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_11:*:*:*:*:*:*",
"matchCriteriaId": "E9B10908-C42B-4763-9D47-236506B0E84A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_12:*:*:*:*:*:*",
"matchCriteriaId": "CF544435-36AC-49B8-BA50-A6B6D1678BBC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_13:*:*:*:*:*:*",
"matchCriteriaId": "9D265542-5333-4CCD-90E5-B5F6A55F9863",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_14:*:*:*:*:*:*",
"matchCriteriaId": "1763CD8B-3ACD-4617-A1CA-B9F77A074977",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_15:*:*:*:*:*:*",
"matchCriteriaId": "F25C66AA-B60D-413C-A848-51E12D6080AC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_16:*:*:*:*:*:*",
"matchCriteriaId": "071A0D53-EC95-4B18-9FA3-55208B1F7B94",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_17:*:*:*:*:*:*",
"matchCriteriaId": "CC26A9D4-14D6-46B1-BB00-A2C4386EBCA4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_18:*:*:*:*:*:*",
"matchCriteriaId": "350CDEDA-9A20-4BC3-BEAE-8346CED10CD6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_19:*:*:*:*:*:*",
"matchCriteriaId": "10C6107E-79B3-4672-B3E5-8A2FA9A829CF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_2:*:*:*:*:*:*",
"matchCriteriaId": "3233D306-3F8E-40A4-B132-7264E63DD131",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_3:*:*:*:*:*:*",
"matchCriteriaId": "9EAEA45A-0370-475E-B4CB-395A434DC3A1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_4:*:*:*:*:*:*",
"matchCriteriaId": "39310F05-1DB6-43BA-811C-9CB91D6DCF20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_5:*:*:*:*:*:*",
"matchCriteriaId": "D6135B16-C89E-4F49-BA15-823E2AF26D68",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_6:*:*:*:*:*:*",
"matchCriteriaId": "CC887BEC-915B-44AC-B473-5448B3D8DCF7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_7:*:*:*:*:*:*",
"matchCriteriaId": "D7A7CC60-C294-41EC-B000-D15AAA93A3D5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_8:*:*:*:*:*:*",
"matchCriteriaId": "022132F8-6E56-4A29-95D6-3B7861D39CDF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_9:*:*:*:*:*:*",
"matchCriteriaId": "651DA9B7-9C11-47A7-AF5C-95625C8FFF6A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:-:*:*:*:*:*:*",
"matchCriteriaId": "8CAAE1B7-982E-4D50-9651-DEEE6CD74EED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_1:*:*:*:*:*:*",
"matchCriteriaId": "AFCF99EC-3384-418D-A419-B9DB607BE371",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_2:*:*:*:*:*:*",
"matchCriteriaId": "31E05134-A0C5-4937-A228-7D0884276B67",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_3:*:*:*:*:*:*",
"matchCriteriaId": "3F06C4AD-FD20-4345-8386-0895312F0A00",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_4:*:*:*:*:*:*",
"matchCriteriaId": "98CC25E2-EC3D-43A2-8D03-06F0E804EA63",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_5:*:*:*:*:*:*",
"matchCriteriaId": "30933C36-C710-488F-9601-EE1BB749C58A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_6:*:*:*:*:*:*",
"matchCriteriaId": "41E94372-A1AE-48B1-82DC-08B7B616473F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_7:*:*:*:*:*:*",
"matchCriteriaId": "51FBC8E0-34F8-475C-A1A8-571791CA05F9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_8:*:*:*:*:*:*",
"matchCriteriaId": "1E73EAEA-FA88-46B9-B9D5-A41603957AD7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:*",
"matchCriteriaId": "12EC8A39-0B8D-47C4-8F54-CB00028EAF3F",
"versionEndExcluding": "7.3.5",
"versionStartIncluding": "7.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in the Asset module\u0027s edit vocabulary page in Liferay Portal 7.0.0 through 7.3.4, and Liferay DXP 7.0 before fix pack 96, 7.1 before fix pack 20, and 7.2 before fix pack 9, allows remote attackers to inject arbitrary web script or HTML via the (1) _com_liferay_journal_web_portlet_JournalPortlet_name or (2) _com_liferay_document_library_web_portlet_DLAdminPortlet_name parameter."
},
{
"lang": "es",
"value": "Una vulnerabilidad de tipo Cross-site scripting (XSS) en la p\u00e1gina de edici\u00f3n de vocabulario del m\u00f3dulo Asset en Liferay Portal versiones 7.0.0 hasta 7.3.4, y Liferay DXP versiones 7.0 anteriores a fix pack 96, versiones 7.1 anteriores a fix pack 20, y versiones 7. 2 anteriores a fix pack 9, permite a atacantes remotos inyectar script web o HTML arbitrario por medio de los par\u00e1metros (1) _com_liferay_journal_web_portlet_JournalPortlet_name o (2) _com_liferay_document_library_web_portlet_DLAdminPortlet_name"
}
],
"id": "CVE-2021-33328",
"lastModified": "2024-11-21T06:08:42.123",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 3.5,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 6.8,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.3,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2021-08-03T19:15:08.823",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://issues.liferay.com/browse/LPE-17100"
},
{
"source": "cve@mitre.org",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120747972"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://issues.liferay.com/browse/LPE-17100"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120747972"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2022-11-15 01:15
Modified
2024-11-21 07:24
Severity ?
Summary
A Cross-site scripting (XSS) vulnerability in the Sharing module's user notification in Liferay Portal 7.2.1 through 7.4.2, and Liferay DXP 7.2 before fix pack 19, and 7.3 before update 4 allows remote attackers to inject arbitrary web script or HTML by sharing an asset with a crafted payload.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| liferay | liferay_portal | * | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.3 | |
| liferay | dxp | 7.3 | |
| liferay | dxp | 7.3 | |
| liferay | dxp | 7.3 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:*",
"matchCriteriaId": "4E8A0D26-A5F7-4228-83B1-92CDA307B5A3",
"versionEndIncluding": "7.4.2",
"versionStartIncluding": "7.2.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:-:*:*:*:*:*:*",
"matchCriteriaId": "8CAAE1B7-982E-4D50-9651-DEEE6CD74EED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_1:*:*:*:*:*:*",
"matchCriteriaId": "AFCF99EC-3384-418D-A419-B9DB607BE371",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_10:*:*:*:*:*:*",
"matchCriteriaId": "F7CAAF53-AA8E-48CB-9398-35461BE590C4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_11:*:*:*:*:*:*",
"matchCriteriaId": "6FB8482E-644B-4DA5-808B-8DBEAB6D8D09",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_12:*:*:*:*:*:*",
"matchCriteriaId": "95EFE8B5-EE95-4186-AC89-E9AFD8649D01",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_13:*:*:*:*:*:*",
"matchCriteriaId": "90A6E0AF-0B8A-462D-95EF-2239EEE4A50D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_14:*:*:*:*:*:*",
"matchCriteriaId": "48BBAE90-F668-49BF-89AF-2C9547B76836",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_15:*:*:*:*:*:*",
"matchCriteriaId": "74FAF597-EAAD-4BB5-AB99-8129476A7E89",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_2:*:*:*:*:*:*",
"matchCriteriaId": "31E05134-A0C5-4937-A228-7D0884276B67",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_3:*:*:*:*:*:*",
"matchCriteriaId": "3F06C4AD-FD20-4345-8386-0895312F0A00",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_4:*:*:*:*:*:*",
"matchCriteriaId": "98CC25E2-EC3D-43A2-8D03-06F0E804EA63",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_5:*:*:*:*:*:*",
"matchCriteriaId": "30933C36-C710-488F-9601-EE1BB749C58A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_6:*:*:*:*:*:*",
"matchCriteriaId": "41E94372-A1AE-48B1-82DC-08B7B616473F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_7:*:*:*:*:*:*",
"matchCriteriaId": "51FBC8E0-34F8-475C-A1A8-571791CA05F9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_8:*:*:*:*:*:*",
"matchCriteriaId": "1E73EAEA-FA88-46B9-B9D5-A41603957AD7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_9:*:*:*:*:*:*",
"matchCriteriaId": "CF9BC654-4E3F-4B40-A6E5-79A818A51BED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.3:-:*:*:*:*:*:*",
"matchCriteriaId": "21C55D41-DB66-494D-BEEB-BDAC7CB4B31B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.3:update_1:*:*:*:*:*:*",
"matchCriteriaId": "D60CDAA3-6029-4904-9D08-BB221BCFD7C3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.3:update_2:*:*:*:*:*:*",
"matchCriteriaId": "B66F47E9-3D82-497E-BD84-E47A65FAF8C3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.3:update_3:*:*:*:*:*:*",
"matchCriteriaId": "A0BA4856-59DF-427C-959F-3B836314F5D5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A Cross-site scripting (XSS) vulnerability in the Sharing module\u0027s user notification in Liferay Portal 7.2.1 through 7.4.2, and Liferay DXP 7.2 before fix pack 19, and 7.3 before update 4 allows remote attackers to inject arbitrary web script or HTML by sharing an asset with a crafted payload."
},
{
"lang": "es",
"value": "Una vulnerabilidad de Cross-Site Scripting (XSS) en la notificaci\u00f3n de usuario del m\u00f3dulo Compartir en Liferay Portal 7.2.1 a 7.4.2, y Liferay DXP 7.2 antes del fix pack 19, y 7.3 antes de la actualizaci\u00f3n 4 permite a atacantes remotos inyectar scripts web o HTML arbitrarios compartiendo un activo con un payload manipulado."
}
],
"id": "CVE-2022-42111",
"lastModified": "2024-11-21T07:24:22.677",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.3,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2022-11-15T01:15:10.227",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Issue Tracking",
"Vendor Advisory"
],
"url": "https://issues.liferay.com/browse/LPE-17379"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42111"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Issue Tracking",
"Vendor Advisory"
],
"url": "https://issues.liferay.com/browse/LPE-17379"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42111"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2021-08-03 19:15
Modified
2024-11-21 06:08
Severity ?
Summary
Insecure default configuration in Liferay Portal 6.2.3 through 7.3.2, and Liferay DXP before 7.3, allows remote attackers to enumerate user email address via the forgot password functionality. The portal.property login.secure.forgot.password should be defaulted to true.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| liferay | dxp | * | |
| liferay | liferay_portal | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:liferay:dxp:*:*:*:*:*:*:*:*",
"matchCriteriaId": "5C0B6536-11D4-48A1-8EC8-FCDFFFD07540",
"versionEndExcluding": "7.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:*",
"matchCriteriaId": "36D56850-2946-4852-8199-6987C873AF18",
"versionEndExcluding": "7.3.3",
"versionStartIncluding": "6.2.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Insecure default configuration in Liferay Portal 6.2.3 through 7.3.2, and Liferay DXP before 7.3, allows remote attackers to enumerate user email address via the forgot password functionality. The portal.property login.secure.forgot.password should be defaulted to true."
},
{
"lang": "es",
"value": "Una configuraci\u00f3n no segura predeterminada en Liferay Portal versiones 6.2.3 hasta 7.3.2, y Liferay DXP versiones anteriores a 7.3, permite a atacantes remotos enumerar la direcci\u00f3n de correo electr\u00f3nico del usuario por medio de la funcionalidad forgot password. La funci\u00f3n portal.property login.secure.forgot.password deber\u00eda estar por defecto en true"
}
],
"id": "CVE-2021-33321",
"lastModified": "2024-11-21T06:08:41.063",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2021-08-03T19:15:08.590",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "https://help.liferay.com/hc/en-us/articles/360050785632"
},
{
"source": "cve@mitre.org",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120748055"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://help.liferay.com/hc/en-us/articles/360050785632"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120748055"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-640"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2022-09-22 00:15
Modified
2024-11-21 06:58
Severity ?
Summary
A cross-site scripting (XSS) vulnerability in Liferay Portal v7.3.3 through v7.4.2 and Liferay DXP v7.3 before service pack 3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the name of a tag.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:liferay:dxp:7.3:-:*:*:*:*:*:*",
"matchCriteriaId": "21C55D41-DB66-494D-BEEB-BDAC7CB4B31B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.3:sp1:*:*:*:*:*:*",
"matchCriteriaId": "9D75A0FF-BAEA-471A-87B2-8EC2A9F0A6B5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.3:sp2:*:*:*:*:*:*",
"matchCriteriaId": "D86CDCC0-9655-477B-83FA-ADDBB5AF43A2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.3:sp3:*:*:*:*:*:*",
"matchCriteriaId": "1CF5B84B-1719-4581-8474-C55CEFFD8305",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:*",
"matchCriteriaId": "5A3A8F5E-502D-4BB3-9D19-E73FF74C00E3",
"versionEndExcluding": "7.4.3.4",
"versionStartIncluding": "7.3.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A cross-site scripting (XSS) vulnerability in Liferay Portal v7.3.3 through v7.4.2 and Liferay DXP v7.3 before service pack 3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the name of a tag."
},
{
"lang": "es",
"value": "Una vulnerabilidad de tipo cross-site scripting (XSS) en Liferay Portal versiones v7.3.3 hasta v7.4.2 y Liferay DXP versiones v7.3 anteriores a service pack 3 permite a atacantes ejecutar scripts web o HTML arbitrarios por medio de una carga \u00fatil dise\u00f1ada inyectada en el nombre de una etiqueta"
}
],
"id": "CVE-2022-28982",
"lastModified": "2024-11-21T06:58:17.343",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2022-09-22T00:15:09.947",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Product"
],
"url": "http://liferay.com"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-28982-reflected-xss-with-tag-name-in-%253Cliferay-asset-asset-tags-selector%253E"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Product"
],
"url": "http://liferay.com"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-28982-reflected-xss-with-tag-name-in-%253Cliferay-asset-asset-tags-selector%253E"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2021-08-04 13:15
Modified
2024-11-21 06:08
Severity ?
Summary
Cross-site scripting (XSS) vulnerability in the Fragment module in Liferay Portal 7.2.1 through 7.3.4, and Liferay DXP 7.2 before fix pack 9 allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_site_admin_web_portlet_SiteAdminPortlet_name parameter.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | https://issues.liferay.com/browse/LPE-17102 | Patch, Vendor Advisory | |
| cve@mitre.org | https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120747934 | Release Notes, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://issues.liferay.com/browse/LPE-17102 | Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120747934 | Release Notes, Vendor Advisory |
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:-:*:*:*:*:*:*",
"matchCriteriaId": "8CAAE1B7-982E-4D50-9651-DEEE6CD74EED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_1:*:*:*:*:*:*",
"matchCriteriaId": "AFCF99EC-3384-418D-A419-B9DB607BE371",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_2:*:*:*:*:*:*",
"matchCriteriaId": "31E05134-A0C5-4937-A228-7D0884276B67",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_3:*:*:*:*:*:*",
"matchCriteriaId": "3F06C4AD-FD20-4345-8386-0895312F0A00",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_4:*:*:*:*:*:*",
"matchCriteriaId": "98CC25E2-EC3D-43A2-8D03-06F0E804EA63",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_5:*:*:*:*:*:*",
"matchCriteriaId": "30933C36-C710-488F-9601-EE1BB749C58A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_6:*:*:*:*:*:*",
"matchCriteriaId": "41E94372-A1AE-48B1-82DC-08B7B616473F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_7:*:*:*:*:*:*",
"matchCriteriaId": "51FBC8E0-34F8-475C-A1A8-571791CA05F9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_8:*:*:*:*:*:*",
"matchCriteriaId": "1E73EAEA-FA88-46B9-B9D5-A41603957AD7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:*",
"matchCriteriaId": "57EC96AE-93E7-4ED9-8A77-825EFBEF060F",
"versionEndExcluding": "7.3.5",
"versionStartIncluding": "7.2.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in the Fragment module in Liferay Portal 7.2.1 through 7.3.4, and Liferay DXP 7.2 before fix pack 9 allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_site_admin_web_portlet_SiteAdminPortlet_name parameter."
},
{
"lang": "es",
"value": "Una vulnerabilidad de tipo Cross-site scripting (XSS) en el m\u00f3dulo Fragment de Liferay Portal versiones 7.2.1 hasta 7.3.4, y Liferay DXP versiones 7.2 anteriores a fix pack 9, permite a atacantes remotos inyectar scripts web o HTML arbitrarios por medio del par\u00e1metro _com_liferay_site_admin_web_portlet_SiteAdminPortlet_name"
}
],
"id": "CVE-2021-33339",
"lastModified": "2024-11-21T06:08:43.730",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 3.5,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 6.8,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 1.7,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2021-08-04T13:15:08.060",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://issues.liferay.com/browse/LPE-17102"
},
{
"source": "cve@mitre.org",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120747934"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://issues.liferay.com/browse/LPE-17102"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120747934"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2022-10-18 21:15
Modified
2024-11-21 07:24
Severity ?
Summary
A Cross-site scripting (XSS) vulnerability in the Role module's edit role assignees page in Liferay Portal 7.4.0 through 7.4.3.36, and Liferay DXP 7.4 before update 37 allows remote attackers to inject arbitrary web script or HTML.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| liferay | dxp | * | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | liferay_portal | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:liferay:dxp:*:*:*:*:*:*:*:*",
"matchCriteriaId": "9751440B-FA20-42E4-9B44-5DDF227CDA1F",
"versionEndExcluding": "7.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:ga1:*:*:*:*:*:*",
"matchCriteriaId": "186D21EA-CD15-4F50-B129-6EF8DCB4FE50",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_1:*:*:*:*:*:*",
"matchCriteriaId": "46AF397F-A95C-4FAD-A6EA-CB623B7A262A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_10:*:*:*:*:*:*",
"matchCriteriaId": "3B8C3B3F-1BBB-47A5-A789-B207B6346FFF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_11:*:*:*:*:*:*",
"matchCriteriaId": "AD5D1171-954A-4E75-813D-E8392CFE4029",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_12:*:*:*:*:*:*",
"matchCriteriaId": "F148098A-D867-4C8B-9632-6B7F24D50C30",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_13:*:*:*:*:*:*",
"matchCriteriaId": "8A112ED2-27C2-45E3-8FA0-6043F7D3BEED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_14:*:*:*:*:*:*",
"matchCriteriaId": "0744AC04-9663-4DA1-9657-EC5BF0C68499",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_15:*:*:*:*:*:*",
"matchCriteriaId": "5703FE2B-011A-4A40-AB67-B989438F2183",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_16:*:*:*:*:*:*",
"matchCriteriaId": "41A54448-B1AB-4E92-8523-5D4A46A83533",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_17:*:*:*:*:*:*",
"matchCriteriaId": "A96A2A4A-3EB3-4074-A846-EC6EECC04B43",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_18:*:*:*:*:*:*",
"matchCriteriaId": "56DAE678-10B9-419D-9F5D-96E3AC3A6E4A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_19:*:*:*:*:*:*",
"matchCriteriaId": "064F4C28-B1F5-44C2-91AA-A09FD56EC0B9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_2:*:*:*:*:*:*",
"matchCriteriaId": "C2C2351E-BDEE-4A79-A00C-6520B54996EF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_20:*:*:*:*:*:*",
"matchCriteriaId": "814D0CE3-B89F-423C-B1E3-47BD0A474491",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_21:*:*:*:*:*:*",
"matchCriteriaId": "58DB7C5A-B4E3-410A-B491-3F322B340BDF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_22:*:*:*:*:*:*",
"matchCriteriaId": "86B581B6-02B0-40B9-BB5C-E28FC51042DB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_23:*:*:*:*:*:*",
"matchCriteriaId": "E7EFBC14-6785-4435-BA96-D77A857BC1C8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_24:*:*:*:*:*:*",
"matchCriteriaId": "585635F8-53DC-4F64-BF6B-C6F72A5F4D29",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_25:*:*:*:*:*:*",
"matchCriteriaId": "355DD7FC-E9C7-43D6-8313-0474AB314F18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_26:*:*:*:*:*:*",
"matchCriteriaId": "B0FDE8B1-444A-4FEB-AC97-4B29C914EB8A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_27:*:*:*:*:*:*",
"matchCriteriaId": "683D063A-0E32-4E2D-8CBF-A57F45071F6E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_28:*:*:*:*:*:*",
"matchCriteriaId": "7DFEBCAB-1D9B-4BED-A2C6-11BA863F1EE9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_29:*:*:*:*:*:*",
"matchCriteriaId": "DB8733C4-8CE4-4E4B-A2AE-919AA69DAF8E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_3:*:*:*:*:*:*",
"matchCriteriaId": "25F5C3E9-CBB0-4114-91A4-41F0E666026A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_30:*:*:*:*:*:*",
"matchCriteriaId": "D372D9B9-5A83-4FF8-8DE5-617D99D1A8B5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_31:*:*:*:*:*:*",
"matchCriteriaId": "7519ABB1-57A7-46F1-97FC-DD44787F2B6E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_32:*:*:*:*:*:*",
"matchCriteriaId": "87BD916B-245C-4D62-B595-1985784C2ABC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_33:*:*:*:*:*:*",
"matchCriteriaId": "841E15A8-0819-4E48-B7E3-3ACCB4C1F43B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_34:*:*:*:*:*:*",
"matchCriteriaId": "91A243D9-7633-4836-B72D-75EF6C0F8876",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_35:*:*:*:*:*:*",
"matchCriteriaId": "6E2B1876-78B1-407A-9392-94FFF33AC803",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_36:*:*:*:*:*:*",
"matchCriteriaId": "4C6BBDC0-9D68-4653-9177-E49B847B04ED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_4:*:*:*:*:*:*",
"matchCriteriaId": "5E2B5687-B311-460E-A562-D754AF271F8E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_5:*:*:*:*:*:*",
"matchCriteriaId": "B49D0CB9-8ED7-46AB-9BA5-7235A2CD9117",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_6:*:*:*:*:*:*",
"matchCriteriaId": "DF169364-096C-4294-B89F-C07AF1DCC9C4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_7:*:*:*:*:*:*",
"matchCriteriaId": "30CB2C54-1A20-4226-ACC6-AC8131899AE2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_8:*:*:*:*:*:*",
"matchCriteriaId": "65693260-5B0F-47AA-BF08-D2979997A40A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_9:*:*:*:*:*:*",
"matchCriteriaId": "C9116909-04C3-4040-B945-4A6225425520",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:*",
"matchCriteriaId": "0086FDBD-9139-44E9-A01B-BE5C59456DC7",
"versionEndExcluding": "7.4.3.37",
"versionStartIncluding": "7.4.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A Cross-site scripting (XSS) vulnerability in the Role module\u0027s edit role assignees page in Liferay Portal 7.4.0 through 7.4.3.36, and Liferay DXP 7.4 before update 37 allows remote attackers to inject arbitrary web script or HTML."
},
{
"lang": "es",
"value": "Una vulnerabilidad de tipo Cross-site scripting (XSS) en la p\u00e1gina de edici\u00f3n de asignados de roles del m\u00f3dulo Role en Liferay Portal versiones 7.4.0 hasta 7.4.3.36, y Liferay DXP versiones 7.4 anteriores a update 37, permite a atacantes remotos inyectar script web o HTML arbitrarios"
}
],
"id": "CVE-2022-42114",
"lastModified": "2024-11-21T07:24:23.137",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.3,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2022-10-18T21:15:16.287",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Product"
],
"url": "http://liferay.com"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42114"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Product"
],
"url": "http://liferay.com"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42114"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2022-10-13 13:15
Modified
2024-11-21 07:17
Severity ?
Summary
A Cross-site scripting (XSS) vulnerability in the Blog module - add new topic functionality in Liferay Digital Experience Platform 7.3.10 SP3 allows remote attackers to inject arbitrary JS script or HTML into the name field of newly created topic.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://liferay.com | Product | |
| cve@mitre.org | https://drive.proton.me/urls/D27RQ14NGW#b71d8XrBl2Mu | Third Party Advisory | |
| cve@mitre.org | https://www.offensity.com/en/blog/authenticated-persistent-xss-in-liferay-dxp-cms-cve-2022-38901-and-cve-2022-38902/ | Exploit, Patch, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://liferay.com | Product | |
| af854a3a-2127-422b-91ae-364da2661108 | https://drive.proton.me/urls/D27RQ14NGW#b71d8XrBl2Mu | Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.offensity.com/en/blog/authenticated-persistent-xss-in-liferay-dxp-cms-cve-2022-38901-and-cve-2022-38902/ | Exploit, Patch, Third Party Advisory |
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:liferay:dxp:7.3:-:*:*:*:*:*:*",
"matchCriteriaId": "21C55D41-DB66-494D-BEEB-BDAC7CB4B31B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.3:sp1:*:*:*:*:*:*",
"matchCriteriaId": "9D75A0FF-BAEA-471A-87B2-8EC2A9F0A6B5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.3:sp2:*:*:*:*:*:*",
"matchCriteriaId": "D86CDCC0-9655-477B-83FA-ADDBB5AF43A2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.3:sp3:*:*:*:*:*:*",
"matchCriteriaId": "1CF5B84B-1719-4581-8474-C55CEFFD8305",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.3:update_1:*:*:*:*:*:*",
"matchCriteriaId": "D60CDAA3-6029-4904-9D08-BB221BCFD7C3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.3:update_2:*:*:*:*:*:*",
"matchCriteriaId": "B66F47E9-3D82-497E-BD84-E47A65FAF8C3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.3:update_3:*:*:*:*:*:*",
"matchCriteriaId": "A0BA4856-59DF-427C-959F-3B836314F5D5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.3:update_4:*:*:*:*:*:*",
"matchCriteriaId": "F3A5ADE1-4743-4A78-9FCC-CEB857012A5B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.3:update_5:*:*:*:*:*:*",
"matchCriteriaId": "2B420A18-5C8B-470F-9189-C84F8DAA74D5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.3:update_6:*:*:*:*:*:*",
"matchCriteriaId": "A7A399C4-6D4B-438C-9BAE-2893E457028A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.3:update_7:*:*:*:*:*:*",
"matchCriteriaId": "0CBACD88-B4F8-4496-9706-C666768AC9B9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.3:update_8:*:*:*:*:*:*",
"matchCriteriaId": "510C440D-8B79-4685-8105-7A21A77CFC61",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:*",
"matchCriteriaId": "52877E3A-4E07-4B14-BABC-B70266FEFEDE",
"versionEndIncluding": "7.4.0",
"versionStartIncluding": "7.3.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A Cross-site scripting (XSS) vulnerability in the Blog module - add new topic functionality in Liferay Digital Experience Platform 7.3.10 SP3 allows remote attackers to inject arbitrary JS script or HTML into the name field of newly created topic."
},
{
"lang": "es",
"value": "Una vulnerabilidad de tipo Cross-site scripting (XSS) en la funcionalidad Blog module - add new topic en Liferay Digital Experience Platform 7.3.10 SP3, permite a atacantes remotos inyectar scripts JS o HTML arbitrarios en el campo del nombre del tema reci\u00e9n creado"
}
],
"id": "CVE-2022-38902",
"lastModified": "2024-11-21T07:17:15.237",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.3,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2022-10-13T13:15:10.043",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Product"
],
"url": "http://liferay.com"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "https://drive.proton.me/urls/D27RQ14NGW#b71d8XrBl2Mu"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Patch",
"Third Party Advisory"
],
"url": "https://www.offensity.com/en/blog/authenticated-persistent-xss-in-liferay-dxp-cms-cve-2022-38901-and-cve-2022-38902/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Product"
],
"url": "http://liferay.com"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://drive.proton.me/urls/D27RQ14NGW#b71d8XrBl2Mu"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Patch",
"Third Party Advisory"
],
"url": "https://www.offensity.com/en/blog/authenticated-persistent-xss-in-liferay-dxp-cms-cve-2022-38901-and-cve-2022-38902/"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2022-11-15 01:15
Modified
2024-11-21 07:24
Severity ?
Summary
Certain Liferay products are vulnerable to Cross Site Scripting (XSS) via the Commerce module. This affects Liferay Portal 7.3.5 through 7.4.2 and Liferay DXP 7.3 before update 8.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://liferay.com | Vendor Advisory | |
| cve@mitre.org | https://issues.liferay.com/browse/LPE-17632 | Issue Tracking, Vendor Advisory | |
| cve@mitre.org | https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42119 | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://liferay.com | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://issues.liferay.com/browse/LPE-17632 | Issue Tracking, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42119 | Vendor Advisory |
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:*",
"matchCriteriaId": "1A81CC5D-37E3-410F-9FD6-7DC84AB286CC",
"versionEndIncluding": "7.4.2",
"versionStartIncluding": "7.3.5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:liferay:dxp:7.3:-:*:*:*:*:*:*",
"matchCriteriaId": "21C55D41-DB66-494D-BEEB-BDAC7CB4B31B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.3:update_1:*:*:*:*:*:*",
"matchCriteriaId": "D60CDAA3-6029-4904-9D08-BB221BCFD7C3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.3:update_2:*:*:*:*:*:*",
"matchCriteriaId": "B66F47E9-3D82-497E-BD84-E47A65FAF8C3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.3:update_3:*:*:*:*:*:*",
"matchCriteriaId": "A0BA4856-59DF-427C-959F-3B836314F5D5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.3:update_4:*:*:*:*:*:*",
"matchCriteriaId": "F3A5ADE1-4743-4A78-9FCC-CEB857012A5B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.3:update_5:*:*:*:*:*:*",
"matchCriteriaId": "2B420A18-5C8B-470F-9189-C84F8DAA74D5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.3:update_6:*:*:*:*:*:*",
"matchCriteriaId": "A7A399C4-6D4B-438C-9BAE-2893E457028A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.3:update_7:*:*:*:*:*:*",
"matchCriteriaId": "0CBACD88-B4F8-4496-9706-C666768AC9B9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Certain Liferay products are vulnerable to Cross Site Scripting (XSS) via the Commerce module. This affects Liferay Portal 7.3.5 through 7.4.2 and Liferay DXP 7.3 before update 8."
},
{
"lang": "es",
"value": "Ciertos productos de Liferay son vulnerables a Cross Site Scripting (XSS) a trav\u00e9s del m\u00f3dulo Commerce. Esto afecta a Liferay Portal 7.3.5 hasta 7.4.2 y Liferay DXP 7.3 antes de la actualizaci\u00f3n 8."
}
],
"id": "CVE-2022-42119",
"lastModified": "2024-11-21T07:24:23.913",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.3,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2022-11-15T01:15:12.587",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://liferay.com"
},
{
"source": "cve@mitre.org",
"tags": [
"Issue Tracking",
"Vendor Advisory"
],
"url": "https://issues.liferay.com/browse/LPE-17632"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42119"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://liferay.com"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Issue Tracking",
"Vendor Advisory"
],
"url": "https://issues.liferay.com/browse/LPE-17632"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42119"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2021-05-17 11:15
Modified
2024-11-21 06:00
Severity ?
Summary
Multiple SQL injection vulnerabilities in Liferay Portal 7.3.5 and Liferay DXP 7.3 before fix pack 1 allow remote authenticated users to execute arbitrary SQL commands via the classPKField parameter to (1) CommerceChannelRelFinder.countByC_C, or (2) CommerceChannelRelFinder.findByC_C.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| liferay | dxp | 7.3 | |
| liferay | liferay_portal | 7.3.5 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:liferay:dxp:7.3:-:*:*:*:*:*:*",
"matchCriteriaId": "21C55D41-DB66-494D-BEEB-BDAC7CB4B31B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:liferay_portal:7.3.5:*:*:*:*:*:*:*",
"matchCriteriaId": "2B842A08-1EDB-4232-89C9-9B966E251B3B",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Multiple SQL injection vulnerabilities in Liferay Portal 7.3.5 and Liferay DXP 7.3 before fix pack 1 allow remote authenticated users to execute arbitrary SQL commands via the classPKField parameter to (1) CommerceChannelRelFinder.countByC_C, or (2) CommerceChannelRelFinder.findByC_C."
},
{
"lang": "es",
"value": "M\u00faltiples vulnerabilidades de inyecci\u00f3n SQL en Liferay Portal versi\u00f3n 7.3.5 y Liferay DXP versiones 7.3 anteriores a fixpack 1, permiten a usuarios autenticados remotos ejecutar comandos SQL arbitrarios por medio del par\u00e1metro classPKField para (1) el archivo CommerceChannelRelFinder.countByC_C, o (2) el archivo CommerceChannelRelFinder.findByC_C"
}
],
"id": "CVE-2021-29053",
"lastModified": "2024-11-21T06:00:36.473",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 8.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2021-05-17T11:15:07.307",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://liferay.com"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120778225"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://liferay.com"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120778225"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-89"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2022-11-15 01:15
Modified
2024-11-21 07:24
Severity ?
Summary
A SQL injection vulnerability in the Friendly Url module in Liferay Portal 7.3.7, and Liferay DXP 7.3 fix pack 2 through update 4 allows attackers to execute arbitrary SQL commands via a crafted payload injected into the `title` field of a friendly URL.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://liferay.com | Vendor Advisory | |
| cve@mitre.org | https://issues.liferay.com/browse/LPE-17520 | Issue Tracking, Vendor Advisory | |
| cve@mitre.org | https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42122 | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://liferay.com | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://issues.liferay.com/browse/LPE-17520 | Issue Tracking, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42122 | Vendor Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| liferay | dxp | 7.3 | |
| liferay | liferay_portal | 7.3.7 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:liferay:dxp:7.3:fix_pack_2:*:*:*:*:*:*",
"matchCriteriaId": "50EA838E-E234-4EE1-8193-5FAD0E093940",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:liferay_portal:7.3.7:*:*:*:*:*:*:*",
"matchCriteriaId": "174B6D58-FBEA-4D06-8FBA-DE08B0DC6111",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A SQL injection vulnerability in the Friendly Url module in Liferay Portal 7.3.7, and Liferay DXP 7.3 fix pack 2 through update 4 allows attackers to execute arbitrary SQL commands via a crafted payload injected into the `title` field of a friendly URL."
},
{
"lang": "es",
"value": "Una vulnerabilidad de inyecci\u00f3n SQL en el m\u00f3dulo URL Amigable en Liferay Portal 7.3.7 y Liferay DXP 7.3 fixpack 2 hasta la actualizaci\u00f3n 4 permite a los atacantes ejecutar comandos SQL arbitrarios a trav\u00e9s de un payload manipulado inyectado en el campo \"t\u00edtulo\" de una URL amigable."
}
],
"id": "CVE-2022-42122",
"lastModified": "2024-11-21T07:24:24.393",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2022-11-15T01:15:12.960",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://liferay.com"
},
{
"source": "cve@mitre.org",
"tags": [
"Issue Tracking",
"Vendor Advisory"
],
"url": "https://issues.liferay.com/browse/LPE-17520"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42122"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://liferay.com"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Issue Tracking",
"Vendor Advisory"
],
"url": "https://issues.liferay.com/browse/LPE-17520"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42122"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-89"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2021-08-04 13:15
Modified
2024-11-21 06:08
Severity ?
Summary
Cross-site scripting (XSS) vulnerability in the Journal module's add article menu in Liferay Portal 7.3.0 through 7.3.3, and Liferay DXP 7.1 fix pack 18, and 7.2 fix pack 5 through 7, allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_journal_web_portlet_JournalPortlet_name parameter.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | liferay_portal | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:-:*:*:*:*:*:*",
"matchCriteriaId": "C2AA7E18-A41B-4F0D-A04F-57C5745D091B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_1:*:*:*:*:*:*",
"matchCriteriaId": "392B783D-620D-4C71-AAA0-848B16964A27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_10:*:*:*:*:*:*",
"matchCriteriaId": "4F5A94E2-22B7-4D2D-A491-29F395E727C5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_11:*:*:*:*:*:*",
"matchCriteriaId": "E9B10908-C42B-4763-9D47-236506B0E84A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_12:*:*:*:*:*:*",
"matchCriteriaId": "CF544435-36AC-49B8-BA50-A6B6D1678BBC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_13:*:*:*:*:*:*",
"matchCriteriaId": "9D265542-5333-4CCD-90E5-B5F6A55F9863",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_14:*:*:*:*:*:*",
"matchCriteriaId": "1763CD8B-3ACD-4617-A1CA-B9F77A074977",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_15:*:*:*:*:*:*",
"matchCriteriaId": "F25C66AA-B60D-413C-A848-51E12D6080AC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_16:*:*:*:*:*:*",
"matchCriteriaId": "071A0D53-EC95-4B18-9FA3-55208B1F7B94",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_17:*:*:*:*:*:*",
"matchCriteriaId": "CC26A9D4-14D6-46B1-BB00-A2C4386EBCA4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_2:*:*:*:*:*:*",
"matchCriteriaId": "3233D306-3F8E-40A4-B132-7264E63DD131",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_3:*:*:*:*:*:*",
"matchCriteriaId": "9EAEA45A-0370-475E-B4CB-395A434DC3A1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_4:*:*:*:*:*:*",
"matchCriteriaId": "39310F05-1DB6-43BA-811C-9CB91D6DCF20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_5:*:*:*:*:*:*",
"matchCriteriaId": "D6135B16-C89E-4F49-BA15-823E2AF26D68",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_6:*:*:*:*:*:*",
"matchCriteriaId": "CC887BEC-915B-44AC-B473-5448B3D8DCF7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_7:*:*:*:*:*:*",
"matchCriteriaId": "D7A7CC60-C294-41EC-B000-D15AAA93A3D5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_8:*:*:*:*:*:*",
"matchCriteriaId": "022132F8-6E56-4A29-95D6-3B7861D39CDF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_9:*:*:*:*:*:*",
"matchCriteriaId": "651DA9B7-9C11-47A7-AF5C-95625C8FFF6A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_5:*:*:*:*:*:*",
"matchCriteriaId": "30933C36-C710-488F-9601-EE1BB749C58A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_6:*:*:*:*:*:*",
"matchCriteriaId": "41E94372-A1AE-48B1-82DC-08B7B616473F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_7:*:*:*:*:*:*",
"matchCriteriaId": "51FBC8E0-34F8-475C-A1A8-571791CA05F9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:*",
"matchCriteriaId": "7E98D77D-3439-437B-AB97-EEDBB70BE03B",
"versionEndExcluding": "7.3.4",
"versionStartIncluding": "7.3.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in the Journal module\u0027s add article menu in Liferay Portal 7.3.0 through 7.3.3, and Liferay DXP 7.1 fix pack 18, and 7.2 fix pack 5 through 7, allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_journal_web_portlet_JournalPortlet_name parameter."
},
{
"lang": "es",
"value": "Una vulnerabilidad de tipo Cross-site scripting (XSS) en el men\u00fa de adici\u00f3n de art\u00edculos del m\u00f3dulo Journal en Liferay Portal versiones 7.3.0 hasta 7.3.3, y Liferay DXP versiones 7.1 fix pack 18, y versiones 7.2 fix pack 5 hasta 7, permite a atacantes remotos inyectar scripts web o HTML arbitrarios por medio del par\u00e1metro _com_liferay_journal_web_portlet_JournalPortlet_name"
}
],
"id": "CVE-2021-33336",
"lastModified": "2024-11-21T06:08:43.257",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 3.5,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 6.8,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.3,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2021-08-04T13:15:08.023",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://issues.liferay.com/browse/LPE-17078"
},
{
"source": "cve@mitre.org",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2021-33336-stored-xss-with-structure-name"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://issues.liferay.com/browse/LPE-17078"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2021-33336-stored-xss-with-structure-name"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2022-09-22 01:15
Modified
2024-11-21 06:58
Severity ?
Summary
Multiple cross-site scripting (XSS) vulnerabilities in Liferay Portal v7.4.3.4 and Liferay DXP v7.4 GA allows attackers to execute arbitrary web scripts or HTML via parameters with the filter_ prefix.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| liferay | dxp | 7.4 | |
| liferay | liferay_portal | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:ga:*:*:*:*:*:*",
"matchCriteriaId": "0DB2556C-DE8B-4102-985D-C65A35A8BE5D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:*",
"matchCriteriaId": "E04E0EDA-8E18-43C3-A0B2-DF45B7CE811D",
"versionEndExcluding": "7.4.3.5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in Liferay Portal v7.4.3.4 and Liferay DXP v7.4 GA allows attackers to execute arbitrary web scripts or HTML via parameters with the filter_ prefix."
},
{
"lang": "es",
"value": "M\u00faltiples vulnerabilidades de tipo cross-site scripting (XSS) en Liferay Portal versi\u00f3n v7.4.3.4 y Liferay DXP versi\u00f3n v7.4 GA, permiten a atacantes ejecutar scripts web o HTML arbitrarios por medio de par\u00e1metros con el prefijo filter_"
}
],
"id": "CVE-2022-28980",
"lastModified": "2024-11-21T06:58:17.043",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2022-09-22T01:15:11.743",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Product"
],
"url": "http://liferay.com"
},
{
"source": "cve@mitre.org",
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-28980-reflected-xss-with-filter_%2A-parameters-in-applied-fragment-filters"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Product"
],
"url": "http://liferay.com"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-28980-reflected-xss-with-filter_%2A-parameters-in-applied-fragment-filters"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2021-08-03 19:15
Modified
2024-11-21 06:08
Severity ?
Summary
The Portlet Configuration module in Liferay Portal 7.2.0 through 7.3.3, and Liferay DXP 7.0 fix pack pack 93 and 94, 7.1 fix pack 18, and 7.2 before fix pack 8, does not properly check user permission, which allows remote authenticated users to view the Guest and User role even if "Role Visibility" is enabled.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | https://issues.liferay.com/browse/LPE-17075 | Patch, Vendor Advisory | |
| cve@mitre.org | https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120747840 | Release Notes, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://issues.liferay.com/browse/LPE-17075 | Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120747840 | Release Notes, Vendor Advisory |
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_93:*:*:*:*:*:*",
"matchCriteriaId": "0B96CDC5-F4DE-49A2-B09D-318163EC9A09",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_94:*:*:*:*:*:*",
"matchCriteriaId": "EEAE13AF-DEEE-4284-A93D-EFE2647E12FB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_18:*:*:*:*:*:*",
"matchCriteriaId": "350CDEDA-9A20-4BC3-BEAE-8346CED10CD6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:-:*:*:*:*:*:*",
"matchCriteriaId": "8CAAE1B7-982E-4D50-9651-DEEE6CD74EED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_1:*:*:*:*:*:*",
"matchCriteriaId": "AFCF99EC-3384-418D-A419-B9DB607BE371",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_2:*:*:*:*:*:*",
"matchCriteriaId": "31E05134-A0C5-4937-A228-7D0884276B67",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_3:*:*:*:*:*:*",
"matchCriteriaId": "3F06C4AD-FD20-4345-8386-0895312F0A00",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_4:*:*:*:*:*:*",
"matchCriteriaId": "98CC25E2-EC3D-43A2-8D03-06F0E804EA63",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_5:*:*:*:*:*:*",
"matchCriteriaId": "30933C36-C710-488F-9601-EE1BB749C58A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_6:*:*:*:*:*:*",
"matchCriteriaId": "41E94372-A1AE-48B1-82DC-08B7B616473F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_7:*:*:*:*:*:*",
"matchCriteriaId": "51FBC8E0-34F8-475C-A1A8-571791CA05F9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:*",
"matchCriteriaId": "B1DA4ECD-E16A-4CD9-BB4B-FF80E3641D67",
"versionEndExcluding": "7.3.4",
"versionStartIncluding": "7.2.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The Portlet Configuration module in Liferay Portal 7.2.0 through 7.3.3, and Liferay DXP 7.0 fix pack pack 93 and 94, 7.1 fix pack 18, and 7.2 before fix pack 8, does not properly check user permission, which allows remote authenticated users to view the Guest and User role even if \"Role Visibility\" is enabled."
},
{
"lang": "es",
"value": "El m\u00f3dulo Portlet Configuration de Liferay Portal versiones 7.2.0 hasta 7.3.3, y Liferay DXP versiones 7.0 fix pack 93 y 94, versiones 7.1 fix pack 18, y versiones 7.2 anteriores a fix pack 8, no comprueba apropiadamente los permisos de usuarios, que permite a usuarios autenticado remoto visualizar el rol de invitado y de usuario incluso si la \"Role Visibility\" est\u00e1 habilitada"
}
],
"id": "CVE-2021-33327",
"lastModified": "2024-11-21T06:08:41.970",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 4.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 1.4,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2021-08-03T19:15:08.787",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://issues.liferay.com/browse/LPE-17075"
},
{
"source": "cve@mitre.org",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120747840"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://issues.liferay.com/browse/LPE-17075"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120747840"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-276"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2022-11-15 01:15
Modified
2024-11-21 07:24
Severity ?
Summary
A SQL injection vulnerability in the Layout module in Liferay Portal 7.1.3 through 7.4.3.4, and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 17, 7.3 before service pack 3, and 7.4 GA allows remote authenticated attackers to execute arbitrary SQL commands via a crafted payload injected into a page template's 'Name' field.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://liferay.com | Vendor Advisory | |
| cve@mitre.org | https://issues.liferay.com/browse/LPE-17414 | Issue Tracking, Vendor Advisory | |
| cve@mitre.org | https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42121 | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://liferay.com | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://issues.liferay.com/browse/LPE-17414 | Issue Tracking, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42121 | Vendor Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| liferay | liferay_portal | * | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.3 | |
| liferay | dxp | 7.3 | |
| liferay | dxp | 7.3 | |
| liferay | dxp | 7.4 | |
| liferay | liferay_portal | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:*",
"matchCriteriaId": "612C5E92-82FF-4C86-A9A4-BC4825033753",
"versionEndIncluding": "7.4.3.4",
"versionStartIncluding": "7.1.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:-:*:*:*:*:*:*",
"matchCriteriaId": "C2AA7E18-A41B-4F0D-A04F-57C5745D091B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_1:*:*:*:*:*:*",
"matchCriteriaId": "392B783D-620D-4C71-AAA0-848B16964A27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_10:*:*:*:*:*:*",
"matchCriteriaId": "4F5A94E2-22B7-4D2D-A491-29F395E727C5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_11:*:*:*:*:*:*",
"matchCriteriaId": "E9B10908-C42B-4763-9D47-236506B0E84A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_12:*:*:*:*:*:*",
"matchCriteriaId": "CF544435-36AC-49B8-BA50-A6B6D1678BBC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_13:*:*:*:*:*:*",
"matchCriteriaId": "9D265542-5333-4CCD-90E5-B5F6A55F9863",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_14:*:*:*:*:*:*",
"matchCriteriaId": "1763CD8B-3ACD-4617-A1CA-B9F77A074977",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_15:*:*:*:*:*:*",
"matchCriteriaId": "F25C66AA-B60D-413C-A848-51E12D6080AC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_16:*:*:*:*:*:*",
"matchCriteriaId": "071A0D53-EC95-4B18-9FA3-55208B1F7B94",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_17:*:*:*:*:*:*",
"matchCriteriaId": "CC26A9D4-14D6-46B1-BB00-A2C4386EBCA4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_18:*:*:*:*:*:*",
"matchCriteriaId": "350CDEDA-9A20-4BC3-BEAE-8346CED10CD6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_19:*:*:*:*:*:*",
"matchCriteriaId": "10C6107E-79B3-4672-B3E5-8A2FA9A829CF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_2:*:*:*:*:*:*",
"matchCriteriaId": "3233D306-3F8E-40A4-B132-7264E63DD131",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_20:*:*:*:*:*:*",
"matchCriteriaId": "A978B14E-96F6-449F-8D8D-8E782A5A3D19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_21:*:*:*:*:*:*",
"matchCriteriaId": "87600A59-7DD1-49F5-A5A5-EA392193C6A3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_22:*:*:*:*:*:*",
"matchCriteriaId": "33EB9718-E83C-43F4-AFF9-86A83F6F75A4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_23:*:*:*:*:*:*",
"matchCriteriaId": "F7CDDDE5-5E00-41AB-8517-2E5A1427633D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_24:*:*:*:*:*:*",
"matchCriteriaId": "D5B4F901-D5A9-440D-86B4-76B42C833660",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_25:*:*:*:*:*:*",
"matchCriteriaId": "1AB262B6-E817-461A-9F05-15B1B37D9019",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_3:*:*:*:*:*:*",
"matchCriteriaId": "9EAEA45A-0370-475E-B4CB-395A434DC3A1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_4:*:*:*:*:*:*",
"matchCriteriaId": "39310F05-1DB6-43BA-811C-9CB91D6DCF20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_5:*:*:*:*:*:*",
"matchCriteriaId": "D6135B16-C89E-4F49-BA15-823E2AF26D68",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_6:*:*:*:*:*:*",
"matchCriteriaId": "CC887BEC-915B-44AC-B473-5448B3D8DCF7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_7:*:*:*:*:*:*",
"matchCriteriaId": "D7A7CC60-C294-41EC-B000-D15AAA93A3D5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_8:*:*:*:*:*:*",
"matchCriteriaId": "022132F8-6E56-4A29-95D6-3B7861D39CDF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_9:*:*:*:*:*:*",
"matchCriteriaId": "651DA9B7-9C11-47A7-AF5C-95625C8FFF6A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:-:*:*:*:*:*:*",
"matchCriteriaId": "8CAAE1B7-982E-4D50-9651-DEEE6CD74EED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_1:*:*:*:*:*:*",
"matchCriteriaId": "AFCF99EC-3384-418D-A419-B9DB607BE371",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_10:*:*:*:*:*:*",
"matchCriteriaId": "F7CAAF53-AA8E-48CB-9398-35461BE590C4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_11:*:*:*:*:*:*",
"matchCriteriaId": "6FB8482E-644B-4DA5-808B-8DBEAB6D8D09",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_12:*:*:*:*:*:*",
"matchCriteriaId": "95EFE8B5-EE95-4186-AC89-E9AFD8649D01",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_13:*:*:*:*:*:*",
"matchCriteriaId": "90A6E0AF-0B8A-462D-95EF-2239EEE4A50D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_14:*:*:*:*:*:*",
"matchCriteriaId": "48BBAE90-F668-49BF-89AF-2C9547B76836",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_15:*:*:*:*:*:*",
"matchCriteriaId": "74FAF597-EAAD-4BB5-AB99-8129476A7E89",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_2:*:*:*:*:*:*",
"matchCriteriaId": "31E05134-A0C5-4937-A228-7D0884276B67",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_3:*:*:*:*:*:*",
"matchCriteriaId": "3F06C4AD-FD20-4345-8386-0895312F0A00",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_4:*:*:*:*:*:*",
"matchCriteriaId": "98CC25E2-EC3D-43A2-8D03-06F0E804EA63",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_5:*:*:*:*:*:*",
"matchCriteriaId": "30933C36-C710-488F-9601-EE1BB749C58A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_6:*:*:*:*:*:*",
"matchCriteriaId": "41E94372-A1AE-48B1-82DC-08B7B616473F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_7:*:*:*:*:*:*",
"matchCriteriaId": "51FBC8E0-34F8-475C-A1A8-571791CA05F9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_8:*:*:*:*:*:*",
"matchCriteriaId": "1E73EAEA-FA88-46B9-B9D5-A41603957AD7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_9:*:*:*:*:*:*",
"matchCriteriaId": "CF9BC654-4E3F-4B40-A6E5-79A818A51BED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.3:-:*:*:*:*:*:*",
"matchCriteriaId": "21C55D41-DB66-494D-BEEB-BDAC7CB4B31B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.3:sp1:*:*:*:*:*:*",
"matchCriteriaId": "9D75A0FF-BAEA-471A-87B2-8EC2A9F0A6B5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.3:sp2:*:*:*:*:*:*",
"matchCriteriaId": "D86CDCC0-9655-477B-83FA-ADDBB5AF43A2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:ga1:*:*:*:*:*:*",
"matchCriteriaId": "186D21EA-CD15-4F50-B129-6EF8DCB4FE50",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:*",
"matchCriteriaId": "201470D2-65E1-40D7-B01B-35A03930BEEA",
"versionEndIncluding": "7.4.2",
"versionStartIncluding": "7.1.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A SQL injection vulnerability in the Layout module in Liferay Portal 7.1.3 through 7.4.3.4, and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 17, 7.3 before service pack 3, and 7.4 GA allows remote authenticated attackers to execute arbitrary SQL commands via a crafted payload injected into a page template\u0027s \u0027Name\u0027 field."
},
{
"lang": "es",
"value": "Una vulnerabilidad de inyecci\u00f3n SQL en el m\u00f3dulo Layout en Liferay Portal 7.1.3 hasta 7.4.3.4, y Liferay DXP 7.1 anterior al fix pack 27, 7.2 anterior al fix pack 17, 7.3 anterior al service pack 3 y 7.4 GA permite a atacantes remotos autenticados ejecutar arbitrariamente Comandos SQL a trav\u00e9s de un payload manipulado inyectado en el campo \u0027Nombre\u0027 de una plantilla de p\u00e1gina."
}
],
"id": "CVE-2022-42121",
"lastModified": "2024-11-21T07:24:24.230",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2022-11-15T01:15:12.843",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://liferay.com"
},
{
"source": "cve@mitre.org",
"tags": [
"Issue Tracking",
"Vendor Advisory"
],
"url": "https://issues.liferay.com/browse/LPE-17414"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42121"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://liferay.com"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Issue Tracking",
"Vendor Advisory"
],
"url": "https://issues.liferay.com/browse/LPE-17414"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42121"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-89"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2022-10-18 21:15
Modified
2024-11-21 07:24
Severity ?
Summary
A Cross-site scripting (XSS) vulnerability in the Portal Search module's Sort widget in Liferay Portal 7.2.0 through 7.4.3.24, and Liferay DXP 7.2 before fix pack 19, 7.3 before update 5, and DXP 7.4 before update 25 allows remote attackers to inject arbitrary web script or HTML via a crafted payload.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| liferay | dxp | * | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.3 | |
| liferay | dxp | 7.3 | |
| liferay | dxp | 7.3 | |
| liferay | dxp | 7.3 | |
| liferay | dxp | 7.3 | |
| liferay | dxp | 7.3 | |
| liferay | dxp | 7.3 | |
| liferay | dxp | 7.3 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | liferay_portal | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:liferay:dxp:*:*:*:*:*:*:*:*",
"matchCriteriaId": "5BC18F4F-2284-4E3E-B8AC-8EDE1649C635",
"versionEndExcluding": "7.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:-:*:*:*:*:*:*",
"matchCriteriaId": "8CAAE1B7-982E-4D50-9651-DEEE6CD74EED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_1:*:*:*:*:*:*",
"matchCriteriaId": "AFCF99EC-3384-418D-A419-B9DB607BE371",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_10:*:*:*:*:*:*",
"matchCriteriaId": "F7CAAF53-AA8E-48CB-9398-35461BE590C4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_11:*:*:*:*:*:*",
"matchCriteriaId": "6FB8482E-644B-4DA5-808B-8DBEAB6D8D09",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_12:*:*:*:*:*:*",
"matchCriteriaId": "95EFE8B5-EE95-4186-AC89-E9AFD8649D01",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_13:*:*:*:*:*:*",
"matchCriteriaId": "90A6E0AF-0B8A-462D-95EF-2239EEE4A50D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_14:*:*:*:*:*:*",
"matchCriteriaId": "48BBAE90-F668-49BF-89AF-2C9547B76836",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_15:*:*:*:*:*:*",
"matchCriteriaId": "74FAF597-EAAD-4BB5-AB99-8129476A7E89",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_18:*:*:*:*:*:*",
"matchCriteriaId": "0058B9A5-7864-4356-ADBA-C9AF1BB74836",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_2:*:*:*:*:*:*",
"matchCriteriaId": "31E05134-A0C5-4937-A228-7D0884276B67",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_3:*:*:*:*:*:*",
"matchCriteriaId": "3F06C4AD-FD20-4345-8386-0895312F0A00",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_4:*:*:*:*:*:*",
"matchCriteriaId": "98CC25E2-EC3D-43A2-8D03-06F0E804EA63",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_5:*:*:*:*:*:*",
"matchCriteriaId": "30933C36-C710-488F-9601-EE1BB749C58A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_6:*:*:*:*:*:*",
"matchCriteriaId": "41E94372-A1AE-48B1-82DC-08B7B616473F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_7:*:*:*:*:*:*",
"matchCriteriaId": "51FBC8E0-34F8-475C-A1A8-571791CA05F9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_8:*:*:*:*:*:*",
"matchCriteriaId": "1E73EAEA-FA88-46B9-B9D5-A41603957AD7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_9:*:*:*:*:*:*",
"matchCriteriaId": "CF9BC654-4E3F-4B40-A6E5-79A818A51BED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.3:-:*:*:*:*:*:*",
"matchCriteriaId": "21C55D41-DB66-494D-BEEB-BDAC7CB4B31B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.3:sp1:*:*:*:*:*:*",
"matchCriteriaId": "9D75A0FF-BAEA-471A-87B2-8EC2A9F0A6B5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.3:sp2:*:*:*:*:*:*",
"matchCriteriaId": "D86CDCC0-9655-477B-83FA-ADDBB5AF43A2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.3:sp3:*:*:*:*:*:*",
"matchCriteriaId": "1CF5B84B-1719-4581-8474-C55CEFFD8305",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.3:update_1:*:*:*:*:*:*",
"matchCriteriaId": "D60CDAA3-6029-4904-9D08-BB221BCFD7C3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.3:update_2:*:*:*:*:*:*",
"matchCriteriaId": "B66F47E9-3D82-497E-BD84-E47A65FAF8C3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.3:update_3:*:*:*:*:*:*",
"matchCriteriaId": "A0BA4856-59DF-427C-959F-3B836314F5D5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.3:update_4:*:*:*:*:*:*",
"matchCriteriaId": "F3A5ADE1-4743-4A78-9FCC-CEB857012A5B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:ga1:*:*:*:*:*:*",
"matchCriteriaId": "186D21EA-CD15-4F50-B129-6EF8DCB4FE50",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_1:*:*:*:*:*:*",
"matchCriteriaId": "46AF397F-A95C-4FAD-A6EA-CB623B7A262A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_10:*:*:*:*:*:*",
"matchCriteriaId": "3B8C3B3F-1BBB-47A5-A789-B207B6346FFF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_11:*:*:*:*:*:*",
"matchCriteriaId": "AD5D1171-954A-4E75-813D-E8392CFE4029",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_12:*:*:*:*:*:*",
"matchCriteriaId": "F148098A-D867-4C8B-9632-6B7F24D50C30",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_13:*:*:*:*:*:*",
"matchCriteriaId": "8A112ED2-27C2-45E3-8FA0-6043F7D3BEED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_14:*:*:*:*:*:*",
"matchCriteriaId": "0744AC04-9663-4DA1-9657-EC5BF0C68499",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_15:*:*:*:*:*:*",
"matchCriteriaId": "5703FE2B-011A-4A40-AB67-B989438F2183",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_16:*:*:*:*:*:*",
"matchCriteriaId": "41A54448-B1AB-4E92-8523-5D4A46A83533",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_17:*:*:*:*:*:*",
"matchCriteriaId": "A96A2A4A-3EB3-4074-A846-EC6EECC04B43",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_18:*:*:*:*:*:*",
"matchCriteriaId": "56DAE678-10B9-419D-9F5D-96E3AC3A6E4A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_19:*:*:*:*:*:*",
"matchCriteriaId": "064F4C28-B1F5-44C2-91AA-A09FD56EC0B9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_2:*:*:*:*:*:*",
"matchCriteriaId": "C2C2351E-BDEE-4A79-A00C-6520B54996EF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_20:*:*:*:*:*:*",
"matchCriteriaId": "814D0CE3-B89F-423C-B1E3-47BD0A474491",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_21:*:*:*:*:*:*",
"matchCriteriaId": "58DB7C5A-B4E3-410A-B491-3F322B340BDF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_22:*:*:*:*:*:*",
"matchCriteriaId": "86B581B6-02B0-40B9-BB5C-E28FC51042DB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_23:*:*:*:*:*:*",
"matchCriteriaId": "E7EFBC14-6785-4435-BA96-D77A857BC1C8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_24:*:*:*:*:*:*",
"matchCriteriaId": "585635F8-53DC-4F64-BF6B-C6F72A5F4D29",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_3:*:*:*:*:*:*",
"matchCriteriaId": "25F5C3E9-CBB0-4114-91A4-41F0E666026A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_4:*:*:*:*:*:*",
"matchCriteriaId": "5E2B5687-B311-460E-A562-D754AF271F8E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_5:*:*:*:*:*:*",
"matchCriteriaId": "B49D0CB9-8ED7-46AB-9BA5-7235A2CD9117",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_6:*:*:*:*:*:*",
"matchCriteriaId": "DF169364-096C-4294-B89F-C07AF1DCC9C4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_7:*:*:*:*:*:*",
"matchCriteriaId": "30CB2C54-1A20-4226-ACC6-AC8131899AE2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_8:*:*:*:*:*:*",
"matchCriteriaId": "65693260-5B0F-47AA-BF08-D2979997A40A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_9:*:*:*:*:*:*",
"matchCriteriaId": "C9116909-04C3-4040-B945-4A6225425520",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:*",
"matchCriteriaId": "2DAC6B76-A5D8-4164-8DF8-1058858F78EE",
"versionEndExcluding": "7.4.3.25",
"versionStartIncluding": "7.2.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A Cross-site scripting (XSS) vulnerability in the Portal Search module\u0027s Sort widget in Liferay Portal 7.2.0 through 7.4.3.24, and Liferay DXP 7.2 before fix pack 19, 7.3 before update 5, and DXP 7.4 before update 25 allows remote attackers to inject arbitrary web script or HTML via a crafted payload."
},
{
"lang": "es",
"value": "Una vulnerabilidad de tipo Cross-site scripting (XSS) en el widget Sort del m\u00f3dulo Portal Search en Liferay Portal versiones 7.2.0 hasta 7.4.3.24, y Liferay DXP 7.2 versiones anteriores a fix pack 19, 7.3 anteriores a update 5, y DXP versiones 7.4 anteriores a update 25, permite a atacantes remotos inyectar scripts web o HTML arbitrarios por medio de una carga \u00fatil dise\u00f1ada"
}
],
"id": "CVE-2022-42112",
"lastModified": "2024-11-21T07:24:22.823",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.3,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2022-10-18T21:15:16.203",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Product"
],
"url": "http://liferay.com"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42112"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Product"
],
"url": "http://liferay.com"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42112"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2021-08-03 21:15
Modified
2024-11-21 06:08
Severity ?
Summary
The Dynamic Data Mapping module in Liferay Portal 7.0.0 through 7.3.2, and Liferay DXP 7.0 before fix pack 94, 7.1 before fix pack 19, and 7.2 before fix pack 6, does not properly check user permissions, which allows remote attackers with the forms "Access in Site Administration" permission to view all forms and form entries in a site via the forms section in site administration.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | https://issues.liferay.com/browse/LPE-17039 | Patch, Vendor Advisory | |
| cve@mitre.org | https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120748332 | Release Notes, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://issues.liferay.com/browse/LPE-17039 | Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120748332 | Release Notes, Vendor Advisory |
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:-:*:*:*:*:*:*",
"matchCriteriaId": "43A92274-7D88-4F0F-8265-CF862011F27F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_13:*:*:*:*:*:*",
"matchCriteriaId": "4874012D-52AA-4C32-95E9-BD331225B4E6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_14:*:*:*:*:*:*",
"matchCriteriaId": "21CAF86F-CEC9-44EE-BAF8-0F7AF9D945F5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_24:*:*:*:*:*:*",
"matchCriteriaId": "EF6C9F29-EEFF-4737-BD50-58572D6C14E9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_25:*:*:*:*:*:*",
"matchCriteriaId": "D24E1FA0-BD94-4AFC-92BF-AEDEBC7DCF4B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_26:*:*:*:*:*:*",
"matchCriteriaId": "FF9B54EE-973B-44B4-8EA2-B58FA49AC561",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_27:*:*:*:*:*:*",
"matchCriteriaId": "A9637223-557D-474B-A46B-D276866376C3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_28:*:*:*:*:*:*",
"matchCriteriaId": "F6306F9C-99DE-4F94-8E7F-6747762BEC45",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_3\\+:*:*:*:*:*:*",
"matchCriteriaId": "2DFF08F0-77C1-43A0-B7DD-9B905BE074EB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_30:*:*:*:*:*:*",
"matchCriteriaId": "48B7015C-26B9-453E-B3CF-9B220D3A8024",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_33:*:*:*:*:*:*",
"matchCriteriaId": "0FEB6921-3C45-4B7E-8B34-CDC34984583D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_35:*:*:*:*:*:*",
"matchCriteriaId": "525F45DC-2E5C-46A8-AEDF-9D6B8FA2EB11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_36:*:*:*:*:*:*",
"matchCriteriaId": "55755D0C-4C0C-42D9-BE5E-5D33C8BA4C7F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_39:*:*:*:*:*:*",
"matchCriteriaId": "FB4FE0F9-EB19-45D7-A953-674629D951F5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_40:*:*:*:*:*:*",
"matchCriteriaId": "22E4B63F-01A9-4F85-92BC-A51F41BE4121",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_41:*:*:*:*:*:*",
"matchCriteriaId": "23BE441D-8770-4F4D-86CD-4E53161F54FB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_42:*:*:*:*:*:*",
"matchCriteriaId": "E14FF010-3907-4C79-B945-C792E446CB31",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_43:*:*:*:*:*:*",
"matchCriteriaId": "B97B5817-B55E-485D-9747-3A50CF7245C8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_44:*:*:*:*:*:*",
"matchCriteriaId": "19EBD671-56BD-45D3-9248-DAF3F47B36FD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_45:*:*:*:*:*:*",
"matchCriteriaId": "93EDC2A1-9622-44DB-ABA8-754D61B60787",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_46:*:*:*:*:*:*",
"matchCriteriaId": "B4B6A06D-C323-431C-9A65-4FD6A6E4CAB6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_47:*:*:*:*:*:*",
"matchCriteriaId": "EE6D4466-1C3A-4D5A-A65C-A30A87EADF1A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_48:*:*:*:*:*:*",
"matchCriteriaId": "4F0BC40A-8E13-4665-A2E4-F5815CA70E17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_49:*:*:*:*:*:*",
"matchCriteriaId": "11FB69C3-7755-495A-AB76-201AF4D9623B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_50:*:*:*:*:*:*",
"matchCriteriaId": "FF66F652-6C08-4D47-865D-36E70360B632",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_51:*:*:*:*:*:*",
"matchCriteriaId": "17B68D59-0509-4C6A-B803-03A02EB76F1F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_52:*:*:*:*:*:*",
"matchCriteriaId": "8F69B287-3B86-4B64-BCB4-40E9495A628D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_53:*:*:*:*:*:*",
"matchCriteriaId": "C627090E-A1BF-4332-9538-EE4E184DB65E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_54:*:*:*:*:*:*",
"matchCriteriaId": "9A089471-9944-4C75-A25F-1F23C18C0CF0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_56:*:*:*:*:*:*",
"matchCriteriaId": "B90E7FBF-6B5B-457A-8B20-ECA69A626BB8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_57:*:*:*:*:*:*",
"matchCriteriaId": "1975C1AB-EF50-42E2-9879-17FB763B45F9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_58:*:*:*:*:*:*",
"matchCriteriaId": "DFB7BB13-773B-47A6-A001-B9EBA46C917E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_59:*:*:*:*:*:*",
"matchCriteriaId": "1C4A2D39-3725-4E80-9F3F-AC1F4EE662E8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_60:*:*:*:*:*:*",
"matchCriteriaId": "BAEDF88B-B9C8-4891-B199-A72C066FC7BF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_61:*:*:*:*:*:*",
"matchCriteriaId": "F768E1DD-3DC6-4783-82DE-D089C7CD3C63",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_64:*:*:*:*:*:*",
"matchCriteriaId": "426EDA92-FE5A-4523-8AAE-1E5D5D67F535",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_65:*:*:*:*:*:*",
"matchCriteriaId": "070CB609-6D4B-4817-9F91-00BD62423E56",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_66:*:*:*:*:*:*",
"matchCriteriaId": "FEE87846-A4CF-47E5-93AA-5D7E2548D28D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_67:*:*:*:*:*:*",
"matchCriteriaId": "A4C11B0E-6D94-4A65-83BE-1E5828710CB9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_68:*:*:*:*:*:*",
"matchCriteriaId": "F1DC73B1-4017-424F-A28D-F54F2FA8ED8C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_69:*:*:*:*:*:*",
"matchCriteriaId": "32B4FD3C-7BB7-4DA2-9A3A-05A6370B9745",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_70:*:*:*:*:*:*",
"matchCriteriaId": "71293E5B-4DCC-47BC-A493-3540D57E6067",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_71:*:*:*:*:*:*",
"matchCriteriaId": "56A8940B-318E-4C6A-9131-A50E90E82C28",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_72:*:*:*:*:*:*",
"matchCriteriaId": "F09B5E82-DC18-4B07-9A05-E433579B4FB5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_73:*:*:*:*:*:*",
"matchCriteriaId": "CE25D189-2D6F-4229-BF09-2CEA0A6C5D50",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_75:*:*:*:*:*:*",
"matchCriteriaId": "36549BE5-DEDB-408A-BFC9-AB00031D45DD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_76:*:*:*:*:*:*",
"matchCriteriaId": "E11B8075-4212-41CB-85AC-09FA1CDB86A1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_78:*:*:*:*:*:*",
"matchCriteriaId": "80412DCE-D79F-492A-8788-6A43C4D76D7C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_79:*:*:*:*:*:*",
"matchCriteriaId": "BC7A939F-21D1-4AF1-BAB9-E91DFCFFB7A2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_80:*:*:*:*:*:*",
"matchCriteriaId": "5F2240FC-EDDC-47F5-B713-07FF2D23CE00",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_81:*:*:*:*:*:*",
"matchCriteriaId": "5006AAE4-B154-468A-850C-20171965E2AC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_82:*:*:*:*:*:*",
"matchCriteriaId": "1541072D-3F14-47A2-8A42-EF2765643AE4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_83:*:*:*:*:*:*",
"matchCriteriaId": "2340C85F-0296-4591-8D23-56634C50C5F8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_84:*:*:*:*:*:*",
"matchCriteriaId": "6BEC3C5C-DA8C-4620-A38E-BB47D4CB7CBA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_85:*:*:*:*:*:*",
"matchCriteriaId": "6DD38B1F-7EEA-4DB5-A31B-D84DC33313FA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_86:*:*:*:*:*:*",
"matchCriteriaId": "FC923A9E-CF9D-44DE-AB58-7BCAAFDDE7D6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_87:*:*:*:*:*:*",
"matchCriteriaId": "65542031-04E1-485F-8102-04CB65865ECE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_88:*:*:*:*:*:*",
"matchCriteriaId": "B36F2FBD-E949-4608-9ECF-0F05DD8E487E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_89:*:*:*:*:*:*",
"matchCriteriaId": "D68832F1-6D71-4A63-AA8A-86C0EDF9F8E1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_90:*:*:*:*:*:*",
"matchCriteriaId": "FD1F579A-084C-46A9-ADCA-8F3FA45D85D6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_91:*:*:*:*:*:*",
"matchCriteriaId": "FC81C494-F68E-4580-87FB-7792C1080DFC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_92:*:*:*:*:*:*",
"matchCriteriaId": "6693594D-6731-4223-8C28-4873746B97AB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_93:*:*:*:*:*:*",
"matchCriteriaId": "0B96CDC5-F4DE-49A2-B09D-318163EC9A09",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:-:*:*:*:*:*:*",
"matchCriteriaId": "C2AA7E18-A41B-4F0D-A04F-57C5745D091B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_1:*:*:*:*:*:*",
"matchCriteriaId": "392B783D-620D-4C71-AAA0-848B16964A27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_10:*:*:*:*:*:*",
"matchCriteriaId": "4F5A94E2-22B7-4D2D-A491-29F395E727C5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_11:*:*:*:*:*:*",
"matchCriteriaId": "E9B10908-C42B-4763-9D47-236506B0E84A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_12:*:*:*:*:*:*",
"matchCriteriaId": "CF544435-36AC-49B8-BA50-A6B6D1678BBC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_13:*:*:*:*:*:*",
"matchCriteriaId": "9D265542-5333-4CCD-90E5-B5F6A55F9863",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_14:*:*:*:*:*:*",
"matchCriteriaId": "1763CD8B-3ACD-4617-A1CA-B9F77A074977",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_15:*:*:*:*:*:*",
"matchCriteriaId": "F25C66AA-B60D-413C-A848-51E12D6080AC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_16:*:*:*:*:*:*",
"matchCriteriaId": "071A0D53-EC95-4B18-9FA3-55208B1F7B94",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_17:*:*:*:*:*:*",
"matchCriteriaId": "CC26A9D4-14D6-46B1-BB00-A2C4386EBCA4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_18:*:*:*:*:*:*",
"matchCriteriaId": "350CDEDA-9A20-4BC3-BEAE-8346CED10CD6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_2:*:*:*:*:*:*",
"matchCriteriaId": "3233D306-3F8E-40A4-B132-7264E63DD131",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_3:*:*:*:*:*:*",
"matchCriteriaId": "9EAEA45A-0370-475E-B4CB-395A434DC3A1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_4:*:*:*:*:*:*",
"matchCriteriaId": "39310F05-1DB6-43BA-811C-9CB91D6DCF20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_5:*:*:*:*:*:*",
"matchCriteriaId": "D6135B16-C89E-4F49-BA15-823E2AF26D68",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_6:*:*:*:*:*:*",
"matchCriteriaId": "CC887BEC-915B-44AC-B473-5448B3D8DCF7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_7:*:*:*:*:*:*",
"matchCriteriaId": "D7A7CC60-C294-41EC-B000-D15AAA93A3D5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_8:*:*:*:*:*:*",
"matchCriteriaId": "022132F8-6E56-4A29-95D6-3B7861D39CDF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_9:*:*:*:*:*:*",
"matchCriteriaId": "651DA9B7-9C11-47A7-AF5C-95625C8FFF6A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:-:*:*:*:*:*:*",
"matchCriteriaId": "8CAAE1B7-982E-4D50-9651-DEEE6CD74EED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_1:*:*:*:*:*:*",
"matchCriteriaId": "AFCF99EC-3384-418D-A419-B9DB607BE371",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_2:*:*:*:*:*:*",
"matchCriteriaId": "31E05134-A0C5-4937-A228-7D0884276B67",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_3:*:*:*:*:*:*",
"matchCriteriaId": "3F06C4AD-FD20-4345-8386-0895312F0A00",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_4:*:*:*:*:*:*",
"matchCriteriaId": "98CC25E2-EC3D-43A2-8D03-06F0E804EA63",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_5:*:*:*:*:*:*",
"matchCriteriaId": "30933C36-C710-488F-9601-EE1BB749C58A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:*",
"matchCriteriaId": "0EE0C481-59B8-4C1D-897D-18AAD8C08F8E",
"versionEndExcluding": "7.3.3",
"versionStartIncluding": "7.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The Dynamic Data Mapping module in Liferay Portal 7.0.0 through 7.3.2, and Liferay DXP 7.0 before fix pack 94, 7.1 before fix pack 19, and 7.2 before fix pack 6, does not properly check user permissions, which allows remote attackers with the forms \"Access in Site Administration\" permission to view all forms and form entries in a site via the forms section in site administration."
},
{
"lang": "es",
"value": "El m\u00f3dulo Dynamic Data Mapping en Liferay Portal versiones 7.0.0 hasta 7.3.2, y Liferay DXP versiones 7.0 anteriores a fix pack 94, versiones 7.1 anteriores a fix pack 19, y versiones 7.2 anteriores a fix pack 6, no comprueba apropiadamente los permisos de usuario, que permite a atacantes remotos con permiso de formularios \"Access in Site Administration\" visualizar todos los formularios y entradas de formularios en un sitio por medio de la secci\u00f3n de formularios en la administraci\u00f3n del sitio"
}
],
"id": "CVE-2021-33334",
"lastModified": "2024-11-21T06:08:42.940",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 4.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 1.4,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2021-08-03T21:15:08.610",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://issues.liferay.com/browse/LPE-17039"
},
{
"source": "cve@mitre.org",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120748332"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://issues.liferay.com/browse/LPE-17039"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120748332"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-276"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2021-05-16 16:15
Modified
2024-11-21 06:00
Severity ?
Summary
Denial-of-service (DoS) vulnerability in the Multi-Factor Authentication module in Liferay DXP 7.3 before fix pack 1 allows remote authenticated attackers to prevent any user from authenticating by (1) enabling Time-based One-time password (TOTP) on behalf of the other user or (2) modifying the other user's TOTP shared secret.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://liferay.com | Vendor Advisory | |
| cve@mitre.org | https://issues.liferay.com/browse/LPE-17131 | Issue Tracking, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://liferay.com | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://issues.liferay.com/browse/LPE-17131 | Issue Tracking, Vendor Advisory |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:liferay:dxp:*:*:*:*:*:*:*:*",
"matchCriteriaId": "5C0B6536-11D4-48A1-8EC8-FCDFFFD07540",
"versionEndExcluding": "7.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.3:-:*:*:*:*:*:*",
"matchCriteriaId": "21C55D41-DB66-494D-BEEB-BDAC7CB4B31B",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Denial-of-service (DoS) vulnerability in the Multi-Factor Authentication module in Liferay DXP 7.3 before fix pack 1 allows remote authenticated attackers to prevent any user from authenticating by (1) enabling Time-based One-time password (TOTP) on behalf of the other user or (2) modifying the other user\u0027s TOTP shared secret."
},
{
"lang": "es",
"value": "Una vulnerabilidad de denegaci\u00f3n de servicio (DoS) en el m\u00f3dulo de autenticaci\u00f3n Multi-Factor en Liferay DXP versiones 7.3 anteriores al fixpack 1, permite a atacantes autenticados remotos impedir a cualquier usuario autenticarse al (1) habilitar la contrase\u00f1a \u00fanica basada en el tiempo (TOTP) en nombre del otro usuario o (2) modificar el secreto compartido de TOTP del otro usuario"
}
],
"id": "CVE-2021-29041",
"lastModified": "2024-11-21T06:00:34.730",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.0,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:S/C:N/I:N/A:P",
"version": "2.0"
},
"exploitabilityScore": 8.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2021-05-16T16:15:07.260",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://liferay.com"
},
{
"source": "cve@mitre.org",
"tags": [
"Issue Tracking",
"Vendor Advisory"
],
"url": "https://issues.liferay.com/browse/LPE-17131"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://liferay.com"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Issue Tracking",
"Vendor Advisory"
],
"url": "https://issues.liferay.com/browse/LPE-17131"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-noinfo"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2022-10-18 21:15
Modified
2024-11-21 07:24
Severity ?
Summary
A Cross-site scripting (XSS) vulnerability in the Frontend Taglib module in Liferay Portal 7.3.2 through 7.4.3.16, and Liferay DXP 7.3 before update 6, and 7.4 before update 17 allows remote attackers to inject arbitrary web script or HTML.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| liferay | dxp | * | |
| liferay | dxp | 7.3 | |
| liferay | dxp | 7.3 | |
| liferay | dxp | 7.3 | |
| liferay | dxp | 7.3 | |
| liferay | dxp | 7.3 | |
| liferay | dxp | 7.3 | |
| liferay | dxp | 7.3 | |
| liferay | dxp | 7.3 | |
| liferay | dxp | 7.3 | |
| liferay | dxp | 7.3 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | liferay_portal | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:liferay:dxp:*:*:*:*:*:*:*:*",
"matchCriteriaId": "5C0B6536-11D4-48A1-8EC8-FCDFFFD07540",
"versionEndExcluding": "7.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.3:*:*:*:*:*:*:*",
"matchCriteriaId": "D7FEE38F-02E9-4801-9030-DFC4223C0E60",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.3:-:*:*:*:*:*:*",
"matchCriteriaId": "21C55D41-DB66-494D-BEEB-BDAC7CB4B31B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.3:sp1:*:*:*:*:*:*",
"matchCriteriaId": "9D75A0FF-BAEA-471A-87B2-8EC2A9F0A6B5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.3:sp2:*:*:*:*:*:*",
"matchCriteriaId": "D86CDCC0-9655-477B-83FA-ADDBB5AF43A2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.3:sp3:*:*:*:*:*:*",
"matchCriteriaId": "1CF5B84B-1719-4581-8474-C55CEFFD8305",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.3:update_1:*:*:*:*:*:*",
"matchCriteriaId": "D60CDAA3-6029-4904-9D08-BB221BCFD7C3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.3:update_2:*:*:*:*:*:*",
"matchCriteriaId": "B66F47E9-3D82-497E-BD84-E47A65FAF8C3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.3:update_3:*:*:*:*:*:*",
"matchCriteriaId": "A0BA4856-59DF-427C-959F-3B836314F5D5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.3:update_4:*:*:*:*:*:*",
"matchCriteriaId": "F3A5ADE1-4743-4A78-9FCC-CEB857012A5B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.3:update_5:*:*:*:*:*:*",
"matchCriteriaId": "2B420A18-5C8B-470F-9189-C84F8DAA74D5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:ga1:*:*:*:*:*:*",
"matchCriteriaId": "186D21EA-CD15-4F50-B129-6EF8DCB4FE50",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_1:*:*:*:*:*:*",
"matchCriteriaId": "46AF397F-A95C-4FAD-A6EA-CB623B7A262A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_10:*:*:*:*:*:*",
"matchCriteriaId": "3B8C3B3F-1BBB-47A5-A789-B207B6346FFF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_11:*:*:*:*:*:*",
"matchCriteriaId": "AD5D1171-954A-4E75-813D-E8392CFE4029",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_12:*:*:*:*:*:*",
"matchCriteriaId": "F148098A-D867-4C8B-9632-6B7F24D50C30",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_13:*:*:*:*:*:*",
"matchCriteriaId": "8A112ED2-27C2-45E3-8FA0-6043F7D3BEED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_14:*:*:*:*:*:*",
"matchCriteriaId": "0744AC04-9663-4DA1-9657-EC5BF0C68499",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_15:*:*:*:*:*:*",
"matchCriteriaId": "5703FE2B-011A-4A40-AB67-B989438F2183",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_16:*:*:*:*:*:*",
"matchCriteriaId": "41A54448-B1AB-4E92-8523-5D4A46A83533",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_2:*:*:*:*:*:*",
"matchCriteriaId": "C2C2351E-BDEE-4A79-A00C-6520B54996EF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_3:*:*:*:*:*:*",
"matchCriteriaId": "25F5C3E9-CBB0-4114-91A4-41F0E666026A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_4:*:*:*:*:*:*",
"matchCriteriaId": "5E2B5687-B311-460E-A562-D754AF271F8E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_5:*:*:*:*:*:*",
"matchCriteriaId": "B49D0CB9-8ED7-46AB-9BA5-7235A2CD9117",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_6:*:*:*:*:*:*",
"matchCriteriaId": "DF169364-096C-4294-B89F-C07AF1DCC9C4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_7:*:*:*:*:*:*",
"matchCriteriaId": "30CB2C54-1A20-4226-ACC6-AC8131899AE2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_8:*:*:*:*:*:*",
"matchCriteriaId": "65693260-5B0F-47AA-BF08-D2979997A40A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_9:*:*:*:*:*:*",
"matchCriteriaId": "C9116909-04C3-4040-B945-4A6225425520",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:*",
"matchCriteriaId": "3E947128-538F-48C9-98F4-339C0760C6FC",
"versionEndIncluding": "7.4.3.16",
"versionStartIncluding": "7.3.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A Cross-site scripting (XSS) vulnerability in the Frontend Taglib module in Liferay Portal 7.3.2 through 7.4.3.16, and Liferay DXP 7.3 before update 6, and 7.4 before update 17 allows remote attackers to inject arbitrary web script or HTML."
},
{
"lang": "es",
"value": "Una vulnerabilidad de tipo Cross-site scripting (XSS) en el m\u00f3dulo Frontend Taglib en Liferay Portal versiones 7.3.2 hasta 7.4.3.16, y Liferay DXP versiones 7.3 anteriores a update 6, y versiones 7.4 anteriores a 17, permite a atacantes remotos inyectar script web o HTML arbitrarios"
}
],
"id": "CVE-2022-42117",
"lastModified": "2024-11-21T07:24:23.603",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2022-10-18T21:15:16.413",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Product"
],
"url": "http://liferay.com"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42117"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Product"
],
"url": "http://liferay.com"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42117"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2022-10-18 21:15
Modified
2024-11-21 07:24
Severity ?
Summary
A Cross-site scripting (XSS) vulnerability in Document Library module in Liferay Portal 7.4.3.30 through 7.4.3.36, and Liferay DXP 7.4 update 30 through update 36 allows remote attackers to inject arbitrary web script or HTML via the `redirect` parameter.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_30:*:*:*:*:*:*",
"matchCriteriaId": "D372D9B9-5A83-4FF8-8DE5-617D99D1A8B5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_31:*:*:*:*:*:*",
"matchCriteriaId": "7519ABB1-57A7-46F1-97FC-DD44787F2B6E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_32:*:*:*:*:*:*",
"matchCriteriaId": "87BD916B-245C-4D62-B595-1985784C2ABC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_33:*:*:*:*:*:*",
"matchCriteriaId": "841E15A8-0819-4E48-B7E3-3ACCB4C1F43B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_34:*:*:*:*:*:*",
"matchCriteriaId": "91A243D9-7633-4836-B72D-75EF6C0F8876",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_35:*:*:*:*:*:*",
"matchCriteriaId": "6E2B1876-78B1-407A-9392-94FFF33AC803",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_36:*:*:*:*:*:*",
"matchCriteriaId": "4C6BBDC0-9D68-4653-9177-E49B847B04ED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:*",
"matchCriteriaId": "C4595361-88D2-42D7-8B52-295572A474E4",
"versionEndExcluding": "7.4.3.37",
"versionStartIncluding": "7.4.3.30",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A Cross-site scripting (XSS) vulnerability in Document Library module in Liferay Portal 7.4.3.30 through 7.4.3.36, and Liferay DXP 7.4 update 30 through update 36 allows remote attackers to inject arbitrary web script or HTML via the `redirect` parameter."
},
{
"lang": "es",
"value": "Una vulnerabilidad de tipo cross-site scripting (XSS) en el m\u00f3dulo Document Library de Liferay Portal versiones 7.4.3.30 hasta 7.4.3.36, y Liferay DXP versiones 7.4 update 30 hasta update 36, permite a atacantes remotos inyectar script web o HTML arbitrarios por medio del par\u00e1metro \"redirect\""
}
],
"id": "CVE-2022-42113",
"lastModified": "2024-11-21T07:24:22.980",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2022-10-18T21:15:16.247",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Product"
],
"url": "http://liferay.com"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42113"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Product"
],
"url": "http://liferay.com"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42113"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2023-06-15 05:15
Modified
2024-11-21 08:07
Severity ?
8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
Cross-site request forgery (CSRF) vulnerability in the Layout module's SEO configuration in Liferay Portal 7.4.3.70 through 7.4.3.76, and Liferay DXP 7.4 update 70 through 76 allows remote attackers to execute arbitrary code in the scripting console via the `_com_liferay_layout_admin_web_portlet_GroupPagesPortlet_backURL` parameter.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_70:*:*:*:*:*:*",
"matchCriteriaId": "3A210A40-99B5-40D6-BBB8-E0E30FADED2E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_71:*:*:*:*:*:*",
"matchCriteriaId": "9ED1C984-729C-4994-B041-12AD82ABB7FB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_72:*:*:*:*:*:*",
"matchCriteriaId": "998F01FB-913B-4224-8413-D62ACCF570E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_73:*:*:*:*:*:*",
"matchCriteriaId": "F18E6353-E96E-4FD6-8CEE-28A30C70AC82",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_74:*:*:*:*:*:*",
"matchCriteriaId": "6102A1C7-26E5-4830-A87F-C7142671261E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_75:*:*:*:*:*:*",
"matchCriteriaId": "57374266-D3DA-4E50-8B4B-19ED8343AC9D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_76:*:*:*:*:*:*",
"matchCriteriaId": "93CCCAAE-8B59-4F59-91E9-860F4313521C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:*",
"matchCriteriaId": "D9014083-2E75-4403-9C1D-C4F07C8DB877",
"versionEndExcluding": "7.4.3.77",
"versionStartIncluding": "7.4.3.70",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross-site request forgery (CSRF) vulnerability in the Layout module\u0027s SEO configuration in Liferay Portal 7.4.3.70 through 7.4.3.76, and Liferay DXP 7.4 update 70 through 76 allows remote attackers to execute arbitrary code in the scripting console via the `_com_liferay_layout_admin_web_portlet_GroupPagesPortlet_backURL` parameter."
}
],
"id": "CVE-2023-35030",
"lastModified": "2024-11-21T08:07:50.727",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 5.9,
"source": "security@liferay.com",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2023-06-15T05:15:09.857",
"references": [
{
"source": "security@liferay.com",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-35030"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-35030"
}
],
"sourceIdentifier": "security@liferay.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-352"
}
],
"source": "security@liferay.com",
"type": "Secondary"
},
{
"description": [
{
"lang": "en",
"value": "CWE-352"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2022-11-15 01:15
Modified
2024-11-21 07:24
Severity ?
Summary
A Cross-site scripting (XSS) vulnerability in the Portal Search module in Liferay Portal 7.1.0 through 7.4.2, and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 15, and 7.3 before service pack 3 allows remote attackers to inject arbitrary web script or HTML via the `tag` parameter.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| liferay | liferay_portal | * | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.3 | |
| liferay | dxp | 7.3 | |
| liferay | dxp | 7.3 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:*",
"matchCriteriaId": "201470D2-65E1-40D7-B01B-35A03930BEEA",
"versionEndIncluding": "7.4.2",
"versionStartIncluding": "7.1.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:-:*:*:*:*:*:*",
"matchCriteriaId": "C2AA7E18-A41B-4F0D-A04F-57C5745D091B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_1:*:*:*:*:*:*",
"matchCriteriaId": "392B783D-620D-4C71-AAA0-848B16964A27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_10:*:*:*:*:*:*",
"matchCriteriaId": "4F5A94E2-22B7-4D2D-A491-29F395E727C5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_11:*:*:*:*:*:*",
"matchCriteriaId": "E9B10908-C42B-4763-9D47-236506B0E84A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_12:*:*:*:*:*:*",
"matchCriteriaId": "CF544435-36AC-49B8-BA50-A6B6D1678BBC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_13:*:*:*:*:*:*",
"matchCriteriaId": "9D265542-5333-4CCD-90E5-B5F6A55F9863",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_14:*:*:*:*:*:*",
"matchCriteriaId": "1763CD8B-3ACD-4617-A1CA-B9F77A074977",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_15:*:*:*:*:*:*",
"matchCriteriaId": "F25C66AA-B60D-413C-A848-51E12D6080AC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_16:*:*:*:*:*:*",
"matchCriteriaId": "071A0D53-EC95-4B18-9FA3-55208B1F7B94",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_17:*:*:*:*:*:*",
"matchCriteriaId": "CC26A9D4-14D6-46B1-BB00-A2C4386EBCA4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_18:*:*:*:*:*:*",
"matchCriteriaId": "350CDEDA-9A20-4BC3-BEAE-8346CED10CD6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_19:*:*:*:*:*:*",
"matchCriteriaId": "10C6107E-79B3-4672-B3E5-8A2FA9A829CF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_2:*:*:*:*:*:*",
"matchCriteriaId": "3233D306-3F8E-40A4-B132-7264E63DD131",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_20:*:*:*:*:*:*",
"matchCriteriaId": "A978B14E-96F6-449F-8D8D-8E782A5A3D19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_21:*:*:*:*:*:*",
"matchCriteriaId": "87600A59-7DD1-49F5-A5A5-EA392193C6A3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_22:*:*:*:*:*:*",
"matchCriteriaId": "33EB9718-E83C-43F4-AFF9-86A83F6F75A4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_23:*:*:*:*:*:*",
"matchCriteriaId": "F7CDDDE5-5E00-41AB-8517-2E5A1427633D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_24:*:*:*:*:*:*",
"matchCriteriaId": "D5B4F901-D5A9-440D-86B4-76B42C833660",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_25:*:*:*:*:*:*",
"matchCriteriaId": "1AB262B6-E817-461A-9F05-15B1B37D9019",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_3:*:*:*:*:*:*",
"matchCriteriaId": "9EAEA45A-0370-475E-B4CB-395A434DC3A1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_4:*:*:*:*:*:*",
"matchCriteriaId": "39310F05-1DB6-43BA-811C-9CB91D6DCF20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_5:*:*:*:*:*:*",
"matchCriteriaId": "D6135B16-C89E-4F49-BA15-823E2AF26D68",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_6:*:*:*:*:*:*",
"matchCriteriaId": "CC887BEC-915B-44AC-B473-5448B3D8DCF7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_7:*:*:*:*:*:*",
"matchCriteriaId": "D7A7CC60-C294-41EC-B000-D15AAA93A3D5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_8:*:*:*:*:*:*",
"matchCriteriaId": "022132F8-6E56-4A29-95D6-3B7861D39CDF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_9:*:*:*:*:*:*",
"matchCriteriaId": "651DA9B7-9C11-47A7-AF5C-95625C8FFF6A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:-:*:*:*:*:*:*",
"matchCriteriaId": "8CAAE1B7-982E-4D50-9651-DEEE6CD74EED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_1:*:*:*:*:*:*",
"matchCriteriaId": "AFCF99EC-3384-418D-A419-B9DB607BE371",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_10:*:*:*:*:*:*",
"matchCriteriaId": "F7CAAF53-AA8E-48CB-9398-35461BE590C4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_11:*:*:*:*:*:*",
"matchCriteriaId": "6FB8482E-644B-4DA5-808B-8DBEAB6D8D09",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_12:*:*:*:*:*:*",
"matchCriteriaId": "95EFE8B5-EE95-4186-AC89-E9AFD8649D01",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_13:*:*:*:*:*:*",
"matchCriteriaId": "90A6E0AF-0B8A-462D-95EF-2239EEE4A50D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_14:*:*:*:*:*:*",
"matchCriteriaId": "48BBAE90-F668-49BF-89AF-2C9547B76836",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_2:*:*:*:*:*:*",
"matchCriteriaId": "31E05134-A0C5-4937-A228-7D0884276B67",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_3:*:*:*:*:*:*",
"matchCriteriaId": "3F06C4AD-FD20-4345-8386-0895312F0A00",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_4:*:*:*:*:*:*",
"matchCriteriaId": "98CC25E2-EC3D-43A2-8D03-06F0E804EA63",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_5:*:*:*:*:*:*",
"matchCriteriaId": "30933C36-C710-488F-9601-EE1BB749C58A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_6:*:*:*:*:*:*",
"matchCriteriaId": "41E94372-A1AE-48B1-82DC-08B7B616473F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_7:*:*:*:*:*:*",
"matchCriteriaId": "51FBC8E0-34F8-475C-A1A8-571791CA05F9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_8:*:*:*:*:*:*",
"matchCriteriaId": "1E73EAEA-FA88-46B9-B9D5-A41603957AD7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_9:*:*:*:*:*:*",
"matchCriteriaId": "CF9BC654-4E3F-4B40-A6E5-79A818A51BED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.3:-:*:*:*:*:*:*",
"matchCriteriaId": "21C55D41-DB66-494D-BEEB-BDAC7CB4B31B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.3:sp1:*:*:*:*:*:*",
"matchCriteriaId": "9D75A0FF-BAEA-471A-87B2-8EC2A9F0A6B5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.3:sp2:*:*:*:*:*:*",
"matchCriteriaId": "D86CDCC0-9655-477B-83FA-ADDBB5AF43A2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A Cross-site scripting (XSS) vulnerability in the Portal Search module in Liferay Portal 7.1.0 through 7.4.2, and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 15, and 7.3 before service pack 3 allows remote attackers to inject arbitrary web script or HTML via the `tag` parameter."
},
{
"lang": "es",
"value": "Una vulnerabilidad de Cross-Site Scripting (XSS) en el m\u00f3dulo Portal Search en Liferay Portal 7.1.0 hasta 7.4.2 y Liferay DXP 7.1 antes del fix pack 27, 7.2 antes del fix pack 15 y 7.3 antes del service pack 3 permite a atacantes remotos inyectar script web o HTML arbitrario a trav\u00e9s del par\u00e1metro \"etiqueta\"."
}
],
"id": "CVE-2022-42118",
"lastModified": "2024-11-21T07:24:23.750",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2022-11-15T01:15:12.410",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://liferay.com"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "https://issues.liferay.com/browse/LPE-17342"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42118"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://liferay.com"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://issues.liferay.com/browse/LPE-17342"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42118"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2021-08-03 19:15
Modified
2024-11-21 06:08
Severity ?
Summary
Liferay Portal 7.2.0 through 7.3.2, and Liferay DXP 7.2 before fix pack 9, allows access to Cross-origin resource sharing (CORS) protected resources if the user is only authenticated using the portal session authentication, which allows remote attackers to obtain sensitive information including the targeted user’s email address and current CSRF token.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | https://issues.liferay.com/browse/LPE-17127 | Patch, Vendor Advisory | |
| cve@mitre.org | https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120747720 | Release Notes, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://issues.liferay.com/browse/LPE-17127 | Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120747720 | Release Notes, Vendor Advisory |
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:-:*:*:*:*:*:*",
"matchCriteriaId": "8CAAE1B7-982E-4D50-9651-DEEE6CD74EED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_1:*:*:*:*:*:*",
"matchCriteriaId": "AFCF99EC-3384-418D-A419-B9DB607BE371",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_2:*:*:*:*:*:*",
"matchCriteriaId": "31E05134-A0C5-4937-A228-7D0884276B67",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_3:*:*:*:*:*:*",
"matchCriteriaId": "3F06C4AD-FD20-4345-8386-0895312F0A00",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_4:*:*:*:*:*:*",
"matchCriteriaId": "98CC25E2-EC3D-43A2-8D03-06F0E804EA63",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_5:*:*:*:*:*:*",
"matchCriteriaId": "30933C36-C710-488F-9601-EE1BB749C58A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_6:*:*:*:*:*:*",
"matchCriteriaId": "41E94372-A1AE-48B1-82DC-08B7B616473F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_7:*:*:*:*:*:*",
"matchCriteriaId": "51FBC8E0-34F8-475C-A1A8-571791CA05F9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_8:*:*:*:*:*:*",
"matchCriteriaId": "1E73EAEA-FA88-46B9-B9D5-A41603957AD7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:*",
"matchCriteriaId": "46F556AC-F439-4A82-8A5C-DAE70647A2A4",
"versionEndExcluding": "7.3.3",
"versionStartIncluding": "7.2.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Liferay Portal 7.2.0 through 7.3.2, and Liferay DXP 7.2 before fix pack 9, allows access to Cross-origin resource sharing (CORS) protected resources if the user is only authenticated using the portal session authentication, which allows remote attackers to obtain sensitive information including the targeted user\u2019s email address and current CSRF token."
},
{
"lang": "es",
"value": "Liferay Portal versiones 7.2.0 hasta 7.3.2, y Liferay DXP versiones 7.2 anteriores a fix pack 9, permite el acceso a recursos protegidos por Cross-origin resource sharing (CORS) si el usuario s\u00f3lo es autenticado usando la autenticaci\u00f3n de sesi\u00f3n del portal, lo que permite a atacantes remotos obtener informaci\u00f3n confidencial, incluyendo la direcci\u00f3n de correo electr\u00f3nico del usuario objetivo y el token de tipo CSRF actual"
}
],
"id": "CVE-2021-33330",
"lastModified": "2024-11-21T06:08:42.287",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 1.4,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2021-08-03T19:15:08.853",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://issues.liferay.com/browse/LPE-17127"
},
{
"source": "cve@mitre.org",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120747720"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://issues.liferay.com/browse/LPE-17127"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120747720"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-noinfo"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2022-10-18 21:15
Modified
2024-11-21 07:24
Severity ?
Summary
A Cross-site scripting (XSS) vulnerability in the Frontend Editor module's integration with CKEditor in Liferay Portal 7.3.2 through 7.4.3.14, and Liferay DXP 7.3 before update 6, and 7.4 before update 15 allows remote attackers to inject arbitrary web script or HTML via the (1) name, or (2) namespace parameter.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| liferay | dxp | * | |
| liferay | dxp | 7.3 | |
| liferay | dxp | 7.3 | |
| liferay | dxp | 7.3 | |
| liferay | dxp | 7.3 | |
| liferay | dxp | 7.3 | |
| liferay | dxp | 7.3 | |
| liferay | dxp | 7.3 | |
| liferay | dxp | 7.3 | |
| liferay | dxp | 7.3 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | liferay_portal | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:liferay:dxp:*:*:*:*:*:*:*:*",
"matchCriteriaId": "5C0B6536-11D4-48A1-8EC8-FCDFFFD07540",
"versionEndExcluding": "7.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.3:-:*:*:*:*:*:*",
"matchCriteriaId": "21C55D41-DB66-494D-BEEB-BDAC7CB4B31B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.3:sp1:*:*:*:*:*:*",
"matchCriteriaId": "9D75A0FF-BAEA-471A-87B2-8EC2A9F0A6B5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.3:sp2:*:*:*:*:*:*",
"matchCriteriaId": "D86CDCC0-9655-477B-83FA-ADDBB5AF43A2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.3:sp3:*:*:*:*:*:*",
"matchCriteriaId": "1CF5B84B-1719-4581-8474-C55CEFFD8305",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.3:update_1:*:*:*:*:*:*",
"matchCriteriaId": "D60CDAA3-6029-4904-9D08-BB221BCFD7C3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.3:update_2:*:*:*:*:*:*",
"matchCriteriaId": "B66F47E9-3D82-497E-BD84-E47A65FAF8C3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.3:update_3:*:*:*:*:*:*",
"matchCriteriaId": "A0BA4856-59DF-427C-959F-3B836314F5D5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.3:update_4:*:*:*:*:*:*",
"matchCriteriaId": "F3A5ADE1-4743-4A78-9FCC-CEB857012A5B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.3:update_5:*:*:*:*:*:*",
"matchCriteriaId": "2B420A18-5C8B-470F-9189-C84F8DAA74D5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:ga1:*:*:*:*:*:*",
"matchCriteriaId": "186D21EA-CD15-4F50-B129-6EF8DCB4FE50",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_1:*:*:*:*:*:*",
"matchCriteriaId": "46AF397F-A95C-4FAD-A6EA-CB623B7A262A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_10:*:*:*:*:*:*",
"matchCriteriaId": "3B8C3B3F-1BBB-47A5-A789-B207B6346FFF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_11:*:*:*:*:*:*",
"matchCriteriaId": "AD5D1171-954A-4E75-813D-E8392CFE4029",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_12:*:*:*:*:*:*",
"matchCriteriaId": "F148098A-D867-4C8B-9632-6B7F24D50C30",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_13:*:*:*:*:*:*",
"matchCriteriaId": "8A112ED2-27C2-45E3-8FA0-6043F7D3BEED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_14:*:*:*:*:*:*",
"matchCriteriaId": "0744AC04-9663-4DA1-9657-EC5BF0C68499",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_2:*:*:*:*:*:*",
"matchCriteriaId": "C2C2351E-BDEE-4A79-A00C-6520B54996EF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_3:*:*:*:*:*:*",
"matchCriteriaId": "25F5C3E9-CBB0-4114-91A4-41F0E666026A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_4:*:*:*:*:*:*",
"matchCriteriaId": "5E2B5687-B311-460E-A562-D754AF271F8E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_5:*:*:*:*:*:*",
"matchCriteriaId": "B49D0CB9-8ED7-46AB-9BA5-7235A2CD9117",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_6:*:*:*:*:*:*",
"matchCriteriaId": "DF169364-096C-4294-B89F-C07AF1DCC9C4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_7:*:*:*:*:*:*",
"matchCriteriaId": "30CB2C54-1A20-4226-ACC6-AC8131899AE2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_8:*:*:*:*:*:*",
"matchCriteriaId": "65693260-5B0F-47AA-BF08-D2979997A40A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_9:*:*:*:*:*:*",
"matchCriteriaId": "C9116909-04C3-4040-B945-4A6225425520",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:*",
"matchCriteriaId": "5DC7AD5B-063F-4C30-A9D9-08C3F90185D9",
"versionEndExcluding": "7.4.3.15",
"versionStartIncluding": "7.3.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A Cross-site scripting (XSS) vulnerability in the Frontend Editor module\u0027s integration with CKEditor in Liferay Portal 7.3.2 through 7.4.3.14, and Liferay DXP 7.3 before update 6, and 7.4 before update 15 allows remote attackers to inject arbitrary web script or HTML via the (1) name, or (2) namespace parameter."
},
{
"lang": "es",
"value": "Una vulnerabilidad de Cross-site scripting (XSS) en la integraci\u00f3n del m\u00f3dulo Frontend Editor con CKEditor en Liferay Portal versiones 7.3.2 hasta 7.4.3.14, y Liferay DXP versiones 7.3 anteriores a update 6, y versiones 7.4 anteriores a update 15, permite a atacantes remotos inyectar script web o HTML arbitrarios por medio del par\u00e1metro (1) name, o (2) namespace"
}
],
"id": "CVE-2022-42116",
"lastModified": "2024-11-21T07:24:23.450",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2022-10-18T21:15:16.373",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Product"
],
"url": "http://liferay.com"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42116"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Product"
],
"url": "http://liferay.com"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42116"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2021-08-03 19:15
Modified
2024-11-21 06:08
Severity ?
Summary
The Layout module in Liferay Portal 7.1.0 through 7.3.1, and Liferay DXP 7.1 before fix pack 20, and 7.2 before fix pack 5, does not properly check permission of pages, which allows remote authenticated users without view permission of a page to view the page via a site's page administration.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | https://issues.liferay.com/browse/LPE-17001 | Patch, Vendor Advisory | |
| cve@mitre.org | https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120747063 | Release Notes, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://issues.liferay.com/browse/LPE-17001 | Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120747063 | Release Notes, Vendor Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | liferay_portal | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:-:*:*:*:*:*:*",
"matchCriteriaId": "C2AA7E18-A41B-4F0D-A04F-57C5745D091B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_1:*:*:*:*:*:*",
"matchCriteriaId": "392B783D-620D-4C71-AAA0-848B16964A27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_10:*:*:*:*:*:*",
"matchCriteriaId": "4F5A94E2-22B7-4D2D-A491-29F395E727C5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_11:*:*:*:*:*:*",
"matchCriteriaId": "E9B10908-C42B-4763-9D47-236506B0E84A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_12:*:*:*:*:*:*",
"matchCriteriaId": "CF544435-36AC-49B8-BA50-A6B6D1678BBC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_13:*:*:*:*:*:*",
"matchCriteriaId": "9D265542-5333-4CCD-90E5-B5F6A55F9863",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_14:*:*:*:*:*:*",
"matchCriteriaId": "1763CD8B-3ACD-4617-A1CA-B9F77A074977",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_15:*:*:*:*:*:*",
"matchCriteriaId": "F25C66AA-B60D-413C-A848-51E12D6080AC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_16:*:*:*:*:*:*",
"matchCriteriaId": "071A0D53-EC95-4B18-9FA3-55208B1F7B94",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_17:*:*:*:*:*:*",
"matchCriteriaId": "CC26A9D4-14D6-46B1-BB00-A2C4386EBCA4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_18:*:*:*:*:*:*",
"matchCriteriaId": "350CDEDA-9A20-4BC3-BEAE-8346CED10CD6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_19:*:*:*:*:*:*",
"matchCriteriaId": "10C6107E-79B3-4672-B3E5-8A2FA9A829CF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_2:*:*:*:*:*:*",
"matchCriteriaId": "3233D306-3F8E-40A4-B132-7264E63DD131",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_3:*:*:*:*:*:*",
"matchCriteriaId": "9EAEA45A-0370-475E-B4CB-395A434DC3A1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_4:*:*:*:*:*:*",
"matchCriteriaId": "39310F05-1DB6-43BA-811C-9CB91D6DCF20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_5:*:*:*:*:*:*",
"matchCriteriaId": "D6135B16-C89E-4F49-BA15-823E2AF26D68",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_6:*:*:*:*:*:*",
"matchCriteriaId": "CC887BEC-915B-44AC-B473-5448B3D8DCF7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_7:*:*:*:*:*:*",
"matchCriteriaId": "D7A7CC60-C294-41EC-B000-D15AAA93A3D5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_8:*:*:*:*:*:*",
"matchCriteriaId": "022132F8-6E56-4A29-95D6-3B7861D39CDF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_9:*:*:*:*:*:*",
"matchCriteriaId": "651DA9B7-9C11-47A7-AF5C-95625C8FFF6A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:-:*:*:*:*:*:*",
"matchCriteriaId": "8CAAE1B7-982E-4D50-9651-DEEE6CD74EED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_1:*:*:*:*:*:*",
"matchCriteriaId": "AFCF99EC-3384-418D-A419-B9DB607BE371",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_2:*:*:*:*:*:*",
"matchCriteriaId": "31E05134-A0C5-4937-A228-7D0884276B67",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_3:*:*:*:*:*:*",
"matchCriteriaId": "3F06C4AD-FD20-4345-8386-0895312F0A00",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_4:*:*:*:*:*:*",
"matchCriteriaId": "98CC25E2-EC3D-43A2-8D03-06F0E804EA63",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:*",
"matchCriteriaId": "81929C82-CE15-45AC-94D6-7B6906C9112E",
"versionEndExcluding": "7.3.2",
"versionStartIncluding": "7.1.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The Layout module in Liferay Portal 7.1.0 through 7.3.1, and Liferay DXP 7.1 before fix pack 20, and 7.2 before fix pack 5, does not properly check permission of pages, which allows remote authenticated users without view permission of a page to view the page via a site\u0027s page administration."
},
{
"lang": "es",
"value": "El m\u00f3dulo Layout en Liferay Portal versiones 7.1.0 hasta 7.3.1, y Liferay DXP versiones 7.1 anterior a fix pack 20, y versiones 7.2 anterior a fix pack 5, no comprueba apropiadamente los permisos de las p\u00e1ginas, que permite a usuarios autenticados remotos sin permiso de visualizaci\u00f3n de una p\u00e1gina visualizar la p\u00e1gina por medio de la administraci\u00f3n de p\u00e1ginas de un sitio"
}
],
"id": "CVE-2021-33324",
"lastModified": "2024-11-21T06:08:41.510",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 4.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 1.4,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2021-08-03T19:15:08.690",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://issues.liferay.com/browse/LPE-17001"
},
{
"source": "cve@mitre.org",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120747063"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://issues.liferay.com/browse/LPE-17001"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120747063"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-276"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2021-05-17 11:15
Modified
2024-11-21 06:00
Severity ?
Summary
Cross-site scripting (XSS) vulnerability in the Site module's membership request administration pages in Liferay Portal 7.0.0 through 7.3.5, and Liferay DXP 7.0 before fix pack 97, 7.1 before fix pack 21, 7.2 before fix pack 10 and 7.3 before fix pack 1 allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_site_my_sites_web_portlet_MySitesPortlet_comments parameter.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:-:*:*:*:*:*:*",
"matchCriteriaId": "43A92274-7D88-4F0F-8265-CF862011F27F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_13:*:*:*:*:*:*",
"matchCriteriaId": "4874012D-52AA-4C32-95E9-BD331225B4E6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_14:*:*:*:*:*:*",
"matchCriteriaId": "21CAF86F-CEC9-44EE-BAF8-0F7AF9D945F5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_24:*:*:*:*:*:*",
"matchCriteriaId": "EF6C9F29-EEFF-4737-BD50-58572D6C14E9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_25:*:*:*:*:*:*",
"matchCriteriaId": "D24E1FA0-BD94-4AFC-92BF-AEDEBC7DCF4B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_26:*:*:*:*:*:*",
"matchCriteriaId": "FF9B54EE-973B-44B4-8EA2-B58FA49AC561",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_27:*:*:*:*:*:*",
"matchCriteriaId": "A9637223-557D-474B-A46B-D276866376C3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_28:*:*:*:*:*:*",
"matchCriteriaId": "F6306F9C-99DE-4F94-8E7F-6747762BEC45",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_3\\+:*:*:*:*:*:*",
"matchCriteriaId": "2DFF08F0-77C1-43A0-B7DD-9B905BE074EB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_30:*:*:*:*:*:*",
"matchCriteriaId": "48B7015C-26B9-453E-B3CF-9B220D3A8024",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_33:*:*:*:*:*:*",
"matchCriteriaId": "0FEB6921-3C45-4B7E-8B34-CDC34984583D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_35:*:*:*:*:*:*",
"matchCriteriaId": "525F45DC-2E5C-46A8-AEDF-9D6B8FA2EB11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_36:*:*:*:*:*:*",
"matchCriteriaId": "55755D0C-4C0C-42D9-BE5E-5D33C8BA4C7F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_39:*:*:*:*:*:*",
"matchCriteriaId": "FB4FE0F9-EB19-45D7-A953-674629D951F5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_40:*:*:*:*:*:*",
"matchCriteriaId": "22E4B63F-01A9-4F85-92BC-A51F41BE4121",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_41:*:*:*:*:*:*",
"matchCriteriaId": "23BE441D-8770-4F4D-86CD-4E53161F54FB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_42:*:*:*:*:*:*",
"matchCriteriaId": "E14FF010-3907-4C79-B945-C792E446CB31",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_43:*:*:*:*:*:*",
"matchCriteriaId": "B97B5817-B55E-485D-9747-3A50CF7245C8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_44:*:*:*:*:*:*",
"matchCriteriaId": "19EBD671-56BD-45D3-9248-DAF3F47B36FD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_45:*:*:*:*:*:*",
"matchCriteriaId": "93EDC2A1-9622-44DB-ABA8-754D61B60787",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_46:*:*:*:*:*:*",
"matchCriteriaId": "B4B6A06D-C323-431C-9A65-4FD6A6E4CAB6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_47:*:*:*:*:*:*",
"matchCriteriaId": "EE6D4466-1C3A-4D5A-A65C-A30A87EADF1A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_48:*:*:*:*:*:*",
"matchCriteriaId": "4F0BC40A-8E13-4665-A2E4-F5815CA70E17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_49:*:*:*:*:*:*",
"matchCriteriaId": "11FB69C3-7755-495A-AB76-201AF4D9623B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_50:*:*:*:*:*:*",
"matchCriteriaId": "FF66F652-6C08-4D47-865D-36E70360B632",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_51:*:*:*:*:*:*",
"matchCriteriaId": "17B68D59-0509-4C6A-B803-03A02EB76F1F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_52:*:*:*:*:*:*",
"matchCriteriaId": "8F69B287-3B86-4B64-BCB4-40E9495A628D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_53:*:*:*:*:*:*",
"matchCriteriaId": "C627090E-A1BF-4332-9538-EE4E184DB65E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_54:*:*:*:*:*:*",
"matchCriteriaId": "9A089471-9944-4C75-A25F-1F23C18C0CF0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_56:*:*:*:*:*:*",
"matchCriteriaId": "B90E7FBF-6B5B-457A-8B20-ECA69A626BB8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_57:*:*:*:*:*:*",
"matchCriteriaId": "1975C1AB-EF50-42E2-9879-17FB763B45F9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_58:*:*:*:*:*:*",
"matchCriteriaId": "DFB7BB13-773B-47A6-A001-B9EBA46C917E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_59:*:*:*:*:*:*",
"matchCriteriaId": "1C4A2D39-3725-4E80-9F3F-AC1F4EE662E8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_60:*:*:*:*:*:*",
"matchCriteriaId": "BAEDF88B-B9C8-4891-B199-A72C066FC7BF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_61:*:*:*:*:*:*",
"matchCriteriaId": "F768E1DD-3DC6-4783-82DE-D089C7CD3C63",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_64:*:*:*:*:*:*",
"matchCriteriaId": "426EDA92-FE5A-4523-8AAE-1E5D5D67F535",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_65:*:*:*:*:*:*",
"matchCriteriaId": "070CB609-6D4B-4817-9F91-00BD62423E56",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_66:*:*:*:*:*:*",
"matchCriteriaId": "FEE87846-A4CF-47E5-93AA-5D7E2548D28D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_67:*:*:*:*:*:*",
"matchCriteriaId": "A4C11B0E-6D94-4A65-83BE-1E5828710CB9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_68:*:*:*:*:*:*",
"matchCriteriaId": "F1DC73B1-4017-424F-A28D-F54F2FA8ED8C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_69:*:*:*:*:*:*",
"matchCriteriaId": "32B4FD3C-7BB7-4DA2-9A3A-05A6370B9745",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_70:*:*:*:*:*:*",
"matchCriteriaId": "71293E5B-4DCC-47BC-A493-3540D57E6067",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_71:*:*:*:*:*:*",
"matchCriteriaId": "56A8940B-318E-4C6A-9131-A50E90E82C28",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_72:*:*:*:*:*:*",
"matchCriteriaId": "F09B5E82-DC18-4B07-9A05-E433579B4FB5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_73:*:*:*:*:*:*",
"matchCriteriaId": "CE25D189-2D6F-4229-BF09-2CEA0A6C5D50",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_75:*:*:*:*:*:*",
"matchCriteriaId": "36549BE5-DEDB-408A-BFC9-AB00031D45DD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_76:*:*:*:*:*:*",
"matchCriteriaId": "E11B8075-4212-41CB-85AC-09FA1CDB86A1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_78:*:*:*:*:*:*",
"matchCriteriaId": "80412DCE-D79F-492A-8788-6A43C4D76D7C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_79:*:*:*:*:*:*",
"matchCriteriaId": "BC7A939F-21D1-4AF1-BAB9-E91DFCFFB7A2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_80:*:*:*:*:*:*",
"matchCriteriaId": "5F2240FC-EDDC-47F5-B713-07FF2D23CE00",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_81:*:*:*:*:*:*",
"matchCriteriaId": "5006AAE4-B154-468A-850C-20171965E2AC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_82:*:*:*:*:*:*",
"matchCriteriaId": "1541072D-3F14-47A2-8A42-EF2765643AE4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_83:*:*:*:*:*:*",
"matchCriteriaId": "2340C85F-0296-4591-8D23-56634C50C5F8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_84:*:*:*:*:*:*",
"matchCriteriaId": "6BEC3C5C-DA8C-4620-A38E-BB47D4CB7CBA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_85:*:*:*:*:*:*",
"matchCriteriaId": "6DD38B1F-7EEA-4DB5-A31B-D84DC33313FA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_86:*:*:*:*:*:*",
"matchCriteriaId": "FC923A9E-CF9D-44DE-AB58-7BCAAFDDE7D6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_87:*:*:*:*:*:*",
"matchCriteriaId": "65542031-04E1-485F-8102-04CB65865ECE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_88:*:*:*:*:*:*",
"matchCriteriaId": "B36F2FBD-E949-4608-9ECF-0F05DD8E487E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_89:*:*:*:*:*:*",
"matchCriteriaId": "D68832F1-6D71-4A63-AA8A-86C0EDF9F8E1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_90:*:*:*:*:*:*",
"matchCriteriaId": "FD1F579A-084C-46A9-ADCA-8F3FA45D85D6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_91:*:*:*:*:*:*",
"matchCriteriaId": "FC81C494-F68E-4580-87FB-7792C1080DFC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_92:*:*:*:*:*:*",
"matchCriteriaId": "6693594D-6731-4223-8C28-4873746B97AB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_93:*:*:*:*:*:*",
"matchCriteriaId": "0B96CDC5-F4DE-49A2-B09D-318163EC9A09",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_94:*:*:*:*:*:*",
"matchCriteriaId": "EEAE13AF-DEEE-4284-A93D-EFE2647E12FB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_95:*:*:*:*:*:*",
"matchCriteriaId": "9EEADDC3-C436-452F-9271-8F30A9D03FE6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_96:*:*:*:*:*:*",
"matchCriteriaId": "A775E68D-A18E-433F-A9D0-AB6E71495936",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_1:*:*:*:*:*:*",
"matchCriteriaId": "392B783D-620D-4C71-AAA0-848B16964A27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_10:*:*:*:*:*:*",
"matchCriteriaId": "4F5A94E2-22B7-4D2D-A491-29F395E727C5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_11:*:*:*:*:*:*",
"matchCriteriaId": "E9B10908-C42B-4763-9D47-236506B0E84A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_12:*:*:*:*:*:*",
"matchCriteriaId": "CF544435-36AC-49B8-BA50-A6B6D1678BBC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_13:*:*:*:*:*:*",
"matchCriteriaId": "9D265542-5333-4CCD-90E5-B5F6A55F9863",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_14:*:*:*:*:*:*",
"matchCriteriaId": "1763CD8B-3ACD-4617-A1CA-B9F77A074977",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_15:*:*:*:*:*:*",
"matchCriteriaId": "F25C66AA-B60D-413C-A848-51E12D6080AC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_16:*:*:*:*:*:*",
"matchCriteriaId": "071A0D53-EC95-4B18-9FA3-55208B1F7B94",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_17:*:*:*:*:*:*",
"matchCriteriaId": "CC26A9D4-14D6-46B1-BB00-A2C4386EBCA4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_18:*:*:*:*:*:*",
"matchCriteriaId": "350CDEDA-9A20-4BC3-BEAE-8346CED10CD6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_19:*:*:*:*:*:*",
"matchCriteriaId": "10C6107E-79B3-4672-B3E5-8A2FA9A829CF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_2:*:*:*:*:*:*",
"matchCriteriaId": "3233D306-3F8E-40A4-B132-7264E63DD131",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_20:*:*:*:*:*:*",
"matchCriteriaId": "A978B14E-96F6-449F-8D8D-8E782A5A3D19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_3:*:*:*:*:*:*",
"matchCriteriaId": "9EAEA45A-0370-475E-B4CB-395A434DC3A1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_4:*:*:*:*:*:*",
"matchCriteriaId": "39310F05-1DB6-43BA-811C-9CB91D6DCF20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_5:*:*:*:*:*:*",
"matchCriteriaId": "D6135B16-C89E-4F49-BA15-823E2AF26D68",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_6:*:*:*:*:*:*",
"matchCriteriaId": "CC887BEC-915B-44AC-B473-5448B3D8DCF7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_7:*:*:*:*:*:*",
"matchCriteriaId": "D7A7CC60-C294-41EC-B000-D15AAA93A3D5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_8:*:*:*:*:*:*",
"matchCriteriaId": "022132F8-6E56-4A29-95D6-3B7861D39CDF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_9:*:*:*:*:*:*",
"matchCriteriaId": "651DA9B7-9C11-47A7-AF5C-95625C8FFF6A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:-:*:*:*:*:*:*",
"matchCriteriaId": "8CAAE1B7-982E-4D50-9651-DEEE6CD74EED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_1:*:*:*:*:*:*",
"matchCriteriaId": "AFCF99EC-3384-418D-A419-B9DB607BE371",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_2:*:*:*:*:*:*",
"matchCriteriaId": "31E05134-A0C5-4937-A228-7D0884276B67",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_3:*:*:*:*:*:*",
"matchCriteriaId": "3F06C4AD-FD20-4345-8386-0895312F0A00",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_4:*:*:*:*:*:*",
"matchCriteriaId": "98CC25E2-EC3D-43A2-8D03-06F0E804EA63",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_5:*:*:*:*:*:*",
"matchCriteriaId": "30933C36-C710-488F-9601-EE1BB749C58A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_6:*:*:*:*:*:*",
"matchCriteriaId": "41E94372-A1AE-48B1-82DC-08B7B616473F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_7:*:*:*:*:*:*",
"matchCriteriaId": "51FBC8E0-34F8-475C-A1A8-571791CA05F9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_8:*:*:*:*:*:*",
"matchCriteriaId": "1E73EAEA-FA88-46B9-B9D5-A41603957AD7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_9:*:*:*:*:*:*",
"matchCriteriaId": "CF9BC654-4E3F-4B40-A6E5-79A818A51BED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.3:-:*:*:*:*:*:*",
"matchCriteriaId": "21C55D41-DB66-494D-BEEB-BDAC7CB4B31B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:*",
"matchCriteriaId": "E447EF84-77FA-448B-8E40-DB216B9B715E",
"versionEndIncluding": "7.3.5",
"versionStartIncluding": "7.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in the Site module\u0027s membership request administration pages in Liferay Portal 7.0.0 through 7.3.5, and Liferay DXP 7.0 before fix pack 97, 7.1 before fix pack 21, 7.2 before fix pack 10 and 7.3 before fix pack 1 allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_site_my_sites_web_portlet_MySitesPortlet_comments parameter."
},
{
"lang": "es",
"value": "Una vulnerabilidad de tipo cross-site scripting (XSS) en las p\u00e1ginas de administraci\u00f3n de peticiones de membres\u00eda del m\u00f3dulo Site en Liferay Portal versiones 7.0.0 hasta 7.3.5, y Liferay DXP versiones 7.0 anteriores al fixpack 97, versiones 7.1 anteriores al fixpack 21, versiones 7.2 anteriores al fixpack 10 y versiones 7.3 anteriores al fixpack 1, permite a atacantes remotos inyectar un script web o HTML arbitrario por medio del par\u00e1metro _com_liferay_site_my_sites_web_portlet_MySitesPortlet_comments"
}
],
"id": "CVE-2021-29044",
"lastModified": "2024-11-21T06:00:35.033",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2021-05-17T11:15:07.210",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://liferay.com"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120743548"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://liferay.com"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120743548"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2021-08-03 19:15
Modified
2024-11-21 06:08
Severity ?
Summary
The Dynamic Data Mapping module in Liferay Portal 7.1.0 through 7.3.2, and Liferay DXP 7.1 before fix pack 19, and 7.2 before fix pack 7, autosaves form values for unauthenticated users, which allows remote attackers to view the autosaved values by viewing the form as an unauthenticated user.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | https://issues.liferay.com/browse/LPE-17049 | Patch, Vendor Advisory | |
| cve@mitre.org | https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120747107 | Release Notes, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://issues.liferay.com/browse/LPE-17049 | Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120747107 | Release Notes, Vendor Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | liferay_portal | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:-:*:*:*:*:*:*",
"matchCriteriaId": "C2AA7E18-A41B-4F0D-A04F-57C5745D091B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_1:*:*:*:*:*:*",
"matchCriteriaId": "392B783D-620D-4C71-AAA0-848B16964A27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_10:*:*:*:*:*:*",
"matchCriteriaId": "4F5A94E2-22B7-4D2D-A491-29F395E727C5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_11:*:*:*:*:*:*",
"matchCriteriaId": "E9B10908-C42B-4763-9D47-236506B0E84A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_12:*:*:*:*:*:*",
"matchCriteriaId": "CF544435-36AC-49B8-BA50-A6B6D1678BBC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_13:*:*:*:*:*:*",
"matchCriteriaId": "9D265542-5333-4CCD-90E5-B5F6A55F9863",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_14:*:*:*:*:*:*",
"matchCriteriaId": "1763CD8B-3ACD-4617-A1CA-B9F77A074977",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_15:*:*:*:*:*:*",
"matchCriteriaId": "F25C66AA-B60D-413C-A848-51E12D6080AC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_16:*:*:*:*:*:*",
"matchCriteriaId": "071A0D53-EC95-4B18-9FA3-55208B1F7B94",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_17:*:*:*:*:*:*",
"matchCriteriaId": "CC26A9D4-14D6-46B1-BB00-A2C4386EBCA4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_18:*:*:*:*:*:*",
"matchCriteriaId": "350CDEDA-9A20-4BC3-BEAE-8346CED10CD6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_2:*:*:*:*:*:*",
"matchCriteriaId": "3233D306-3F8E-40A4-B132-7264E63DD131",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_3:*:*:*:*:*:*",
"matchCriteriaId": "9EAEA45A-0370-475E-B4CB-395A434DC3A1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_4:*:*:*:*:*:*",
"matchCriteriaId": "39310F05-1DB6-43BA-811C-9CB91D6DCF20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_5:*:*:*:*:*:*",
"matchCriteriaId": "D6135B16-C89E-4F49-BA15-823E2AF26D68",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_6:*:*:*:*:*:*",
"matchCriteriaId": "CC887BEC-915B-44AC-B473-5448B3D8DCF7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_7:*:*:*:*:*:*",
"matchCriteriaId": "D7A7CC60-C294-41EC-B000-D15AAA93A3D5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_8:*:*:*:*:*:*",
"matchCriteriaId": "022132F8-6E56-4A29-95D6-3B7861D39CDF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_9:*:*:*:*:*:*",
"matchCriteriaId": "651DA9B7-9C11-47A7-AF5C-95625C8FFF6A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:-:*:*:*:*:*:*",
"matchCriteriaId": "8CAAE1B7-982E-4D50-9651-DEEE6CD74EED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_1:*:*:*:*:*:*",
"matchCriteriaId": "AFCF99EC-3384-418D-A419-B9DB607BE371",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_2:*:*:*:*:*:*",
"matchCriteriaId": "31E05134-A0C5-4937-A228-7D0884276B67",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_3:*:*:*:*:*:*",
"matchCriteriaId": "3F06C4AD-FD20-4345-8386-0895312F0A00",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_4:*:*:*:*:*:*",
"matchCriteriaId": "98CC25E2-EC3D-43A2-8D03-06F0E804EA63",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_5:*:*:*:*:*:*",
"matchCriteriaId": "30933C36-C710-488F-9601-EE1BB749C58A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_6:*:*:*:*:*:*",
"matchCriteriaId": "41E94372-A1AE-48B1-82DC-08B7B616473F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:*",
"matchCriteriaId": "99862578-46EC-4BB6-9CEF-EE5293BDCF8E",
"versionEndExcluding": "7.3.1",
"versionStartIncluding": "7.1.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The Dynamic Data Mapping module in Liferay Portal 7.1.0 through 7.3.2, and Liferay DXP 7.1 before fix pack 19, and 7.2 before fix pack 7, autosaves form values for unauthenticated users, which allows remote attackers to view the autosaved values by viewing the form as an unauthenticated user."
},
{
"lang": "es",
"value": "El m\u00f3dulo Dynamic Data Mapping en Liferay Portal versiones 7.1.0 hasta 7.3.2, y Liferay DXP versiones 7.1 anterior a fix pack 19, y versiones 7.2 anterior a fix pack 7, guarda autom\u00e1ticamente los valores de los formularios para usuarios no autenticados, que permite a atacantes remotos visualizar los valores guardados autom\u00e1ticamente al visualizar el formulario como un usuario no autenticado"
}
],
"id": "CVE-2021-33323",
"lastModified": "2024-11-21T06:08:41.367",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2021-08-03T19:15:08.657",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://issues.liferay.com/browse/LPE-17049"
},
{
"source": "cve@mitre.org",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120747107"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://issues.liferay.com/browse/LPE-17049"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120747107"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-312"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2021-08-04 14:15
Modified
2024-11-21 06:08
Severity ?
Summary
Cross-site scripting (XSS) vulnerability in the Document Library module's add document menu in Liferay Portal 7.3.0 through 7.3.4, and Liferay DXP 7.1 before fix pack 20, and 7.2 before fix pack 9, allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_document_library_web_portlet_DLAdminPortlet_name parameter.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | liferay_portal | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:-:*:*:*:*:*:*",
"matchCriteriaId": "C2AA7E18-A41B-4F0D-A04F-57C5745D091B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_1:*:*:*:*:*:*",
"matchCriteriaId": "392B783D-620D-4C71-AAA0-848B16964A27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_10:*:*:*:*:*:*",
"matchCriteriaId": "4F5A94E2-22B7-4D2D-A491-29F395E727C5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_11:*:*:*:*:*:*",
"matchCriteriaId": "E9B10908-C42B-4763-9D47-236506B0E84A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_12:*:*:*:*:*:*",
"matchCriteriaId": "CF544435-36AC-49B8-BA50-A6B6D1678BBC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_13:*:*:*:*:*:*",
"matchCriteriaId": "9D265542-5333-4CCD-90E5-B5F6A55F9863",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_14:*:*:*:*:*:*",
"matchCriteriaId": "1763CD8B-3ACD-4617-A1CA-B9F77A074977",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_15:*:*:*:*:*:*",
"matchCriteriaId": "F25C66AA-B60D-413C-A848-51E12D6080AC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_16:*:*:*:*:*:*",
"matchCriteriaId": "071A0D53-EC95-4B18-9FA3-55208B1F7B94",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_17:*:*:*:*:*:*",
"matchCriteriaId": "CC26A9D4-14D6-46B1-BB00-A2C4386EBCA4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_18:*:*:*:*:*:*",
"matchCriteriaId": "350CDEDA-9A20-4BC3-BEAE-8346CED10CD6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_19:*:*:*:*:*:*",
"matchCriteriaId": "10C6107E-79B3-4672-B3E5-8A2FA9A829CF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_2:*:*:*:*:*:*",
"matchCriteriaId": "3233D306-3F8E-40A4-B132-7264E63DD131",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_3:*:*:*:*:*:*",
"matchCriteriaId": "9EAEA45A-0370-475E-B4CB-395A434DC3A1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_4:*:*:*:*:*:*",
"matchCriteriaId": "39310F05-1DB6-43BA-811C-9CB91D6DCF20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_5:*:*:*:*:*:*",
"matchCriteriaId": "D6135B16-C89E-4F49-BA15-823E2AF26D68",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_6:*:*:*:*:*:*",
"matchCriteriaId": "CC887BEC-915B-44AC-B473-5448B3D8DCF7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_7:*:*:*:*:*:*",
"matchCriteriaId": "D7A7CC60-C294-41EC-B000-D15AAA93A3D5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_8:*:*:*:*:*:*",
"matchCriteriaId": "022132F8-6E56-4A29-95D6-3B7861D39CDF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_9:*:*:*:*:*:*",
"matchCriteriaId": "651DA9B7-9C11-47A7-AF5C-95625C8FFF6A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:-:*:*:*:*:*:*",
"matchCriteriaId": "8CAAE1B7-982E-4D50-9651-DEEE6CD74EED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_1:*:*:*:*:*:*",
"matchCriteriaId": "AFCF99EC-3384-418D-A419-B9DB607BE371",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_2:*:*:*:*:*:*",
"matchCriteriaId": "31E05134-A0C5-4937-A228-7D0884276B67",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_3:*:*:*:*:*:*",
"matchCriteriaId": "3F06C4AD-FD20-4345-8386-0895312F0A00",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_4:*:*:*:*:*:*",
"matchCriteriaId": "98CC25E2-EC3D-43A2-8D03-06F0E804EA63",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_5:*:*:*:*:*:*",
"matchCriteriaId": "30933C36-C710-488F-9601-EE1BB749C58A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_6:*:*:*:*:*:*",
"matchCriteriaId": "41E94372-A1AE-48B1-82DC-08B7B616473F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_7:*:*:*:*:*:*",
"matchCriteriaId": "51FBC8E0-34F8-475C-A1A8-571791CA05F9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_8:*:*:*:*:*:*",
"matchCriteriaId": "1E73EAEA-FA88-46B9-B9D5-A41603957AD7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:*",
"matchCriteriaId": "8CDF8752-7AE9-43E4-81AD-DFD179486504",
"versionEndIncluding": "7.3.4",
"versionStartIncluding": "7.3.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in the Document Library module\u0027s add document menu in Liferay Portal 7.3.0 through 7.3.4, and Liferay DXP 7.1 before fix pack 20, and 7.2 before fix pack 9, allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_document_library_web_portlet_DLAdminPortlet_name parameter."
},
{
"lang": "es",
"value": "Una vulnerabilidad de tipo Cross-site scripting (XSS) en el men\u00fa de adici\u00f3n de documentos del m\u00f3dulo de la Biblioteca de Documentos en Liferay Portal versiones 7.3.0 hasta 7.3.4, y Liferay DXP versiones 7.1 anteriores a fix pack 20, y versiones 7.2 anteriores a fix pack 9, permite a atacantes remotos inyectar script web o HTML arbitrarios por medio del par\u00e1metro _com_liferay_document_library_web_portlet_DLAdminPortlet_name"
}
],
"id": "CVE-2021-33337",
"lastModified": "2024-11-21T06:08:43.423",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2021-08-04T14:15:08.317",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Issue Tracking",
"Vendor Advisory"
],
"url": "https://issues.liferay.com/browse/LPE-17101"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2021-33337-stored-xss-with-document-types-in-documents-and-media"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Issue Tracking",
"Vendor Advisory"
],
"url": "https://issues.liferay.com/browse/LPE-17101"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2021-33337-stored-xss-with-document-types-in-documents-and-media"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2021-06-09 19:15
Modified
2024-11-21 06:00
Severity ?
Summary
Cross-site scripting (XSS) vulnerability in the Portal Workflow module's edit process page in Liferay DXP 7.0 before fix pack 99, 7.1 before fix pack 23, 7.2 before fix pack 12 and 7.3 before fix pack 1, allows remote attackers to inject arbitrary web script or HTML via the currentURL parameter.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://liferay.com | Vendor Advisory | |
| cve@mitre.org | https://issues.liferay.com/browse/LPE-17211 | Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://liferay.com | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://issues.liferay.com/browse/LPE-17211 | Patch, Vendor Advisory |
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:-:*:*:*:*:*:*",
"matchCriteriaId": "43A92274-7D88-4F0F-8265-CF862011F27F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_13:*:*:*:*:*:*",
"matchCriteriaId": "4874012D-52AA-4C32-95E9-BD331225B4E6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_14:*:*:*:*:*:*",
"matchCriteriaId": "21CAF86F-CEC9-44EE-BAF8-0F7AF9D945F5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_24:*:*:*:*:*:*",
"matchCriteriaId": "EF6C9F29-EEFF-4737-BD50-58572D6C14E9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_25:*:*:*:*:*:*",
"matchCriteriaId": "D24E1FA0-BD94-4AFC-92BF-AEDEBC7DCF4B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_26:*:*:*:*:*:*",
"matchCriteriaId": "FF9B54EE-973B-44B4-8EA2-B58FA49AC561",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_27:*:*:*:*:*:*",
"matchCriteriaId": "A9637223-557D-474B-A46B-D276866376C3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_28:*:*:*:*:*:*",
"matchCriteriaId": "F6306F9C-99DE-4F94-8E7F-6747762BEC45",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_3\\+:*:*:*:*:*:*",
"matchCriteriaId": "2DFF08F0-77C1-43A0-B7DD-9B905BE074EB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_30:*:*:*:*:*:*",
"matchCriteriaId": "48B7015C-26B9-453E-B3CF-9B220D3A8024",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_33:*:*:*:*:*:*",
"matchCriteriaId": "0FEB6921-3C45-4B7E-8B34-CDC34984583D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_35:*:*:*:*:*:*",
"matchCriteriaId": "525F45DC-2E5C-46A8-AEDF-9D6B8FA2EB11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_36:*:*:*:*:*:*",
"matchCriteriaId": "55755D0C-4C0C-42D9-BE5E-5D33C8BA4C7F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_39:*:*:*:*:*:*",
"matchCriteriaId": "FB4FE0F9-EB19-45D7-A953-674629D951F5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_40:*:*:*:*:*:*",
"matchCriteriaId": "22E4B63F-01A9-4F85-92BC-A51F41BE4121",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_41:*:*:*:*:*:*",
"matchCriteriaId": "23BE441D-8770-4F4D-86CD-4E53161F54FB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_42:*:*:*:*:*:*",
"matchCriteriaId": "E14FF010-3907-4C79-B945-C792E446CB31",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_43:*:*:*:*:*:*",
"matchCriteriaId": "B97B5817-B55E-485D-9747-3A50CF7245C8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_44:*:*:*:*:*:*",
"matchCriteriaId": "19EBD671-56BD-45D3-9248-DAF3F47B36FD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_45:*:*:*:*:*:*",
"matchCriteriaId": "93EDC2A1-9622-44DB-ABA8-754D61B60787",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_46:*:*:*:*:*:*",
"matchCriteriaId": "B4B6A06D-C323-431C-9A65-4FD6A6E4CAB6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_47:*:*:*:*:*:*",
"matchCriteriaId": "EE6D4466-1C3A-4D5A-A65C-A30A87EADF1A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_48:*:*:*:*:*:*",
"matchCriteriaId": "4F0BC40A-8E13-4665-A2E4-F5815CA70E17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_49:*:*:*:*:*:*",
"matchCriteriaId": "11FB69C3-7755-495A-AB76-201AF4D9623B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_50:*:*:*:*:*:*",
"matchCriteriaId": "FF66F652-6C08-4D47-865D-36E70360B632",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_51:*:*:*:*:*:*",
"matchCriteriaId": "17B68D59-0509-4C6A-B803-03A02EB76F1F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_52:*:*:*:*:*:*",
"matchCriteriaId": "8F69B287-3B86-4B64-BCB4-40E9495A628D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_53:*:*:*:*:*:*",
"matchCriteriaId": "C627090E-A1BF-4332-9538-EE4E184DB65E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_54:*:*:*:*:*:*",
"matchCriteriaId": "9A089471-9944-4C75-A25F-1F23C18C0CF0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_56:*:*:*:*:*:*",
"matchCriteriaId": "B90E7FBF-6B5B-457A-8B20-ECA69A626BB8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_57:*:*:*:*:*:*",
"matchCriteriaId": "1975C1AB-EF50-42E2-9879-17FB763B45F9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_58:*:*:*:*:*:*",
"matchCriteriaId": "DFB7BB13-773B-47A6-A001-B9EBA46C917E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_59:*:*:*:*:*:*",
"matchCriteriaId": "1C4A2D39-3725-4E80-9F3F-AC1F4EE662E8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_60:*:*:*:*:*:*",
"matchCriteriaId": "BAEDF88B-B9C8-4891-B199-A72C066FC7BF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_61:*:*:*:*:*:*",
"matchCriteriaId": "F768E1DD-3DC6-4783-82DE-D089C7CD3C63",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_64:*:*:*:*:*:*",
"matchCriteriaId": "426EDA92-FE5A-4523-8AAE-1E5D5D67F535",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_65:*:*:*:*:*:*",
"matchCriteriaId": "070CB609-6D4B-4817-9F91-00BD62423E56",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_66:*:*:*:*:*:*",
"matchCriteriaId": "FEE87846-A4CF-47E5-93AA-5D7E2548D28D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_67:*:*:*:*:*:*",
"matchCriteriaId": "A4C11B0E-6D94-4A65-83BE-1E5828710CB9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_68:*:*:*:*:*:*",
"matchCriteriaId": "F1DC73B1-4017-424F-A28D-F54F2FA8ED8C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_69:*:*:*:*:*:*",
"matchCriteriaId": "32B4FD3C-7BB7-4DA2-9A3A-05A6370B9745",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_70:*:*:*:*:*:*",
"matchCriteriaId": "71293E5B-4DCC-47BC-A493-3540D57E6067",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_71:*:*:*:*:*:*",
"matchCriteriaId": "56A8940B-318E-4C6A-9131-A50E90E82C28",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_72:*:*:*:*:*:*",
"matchCriteriaId": "F09B5E82-DC18-4B07-9A05-E433579B4FB5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_73:*:*:*:*:*:*",
"matchCriteriaId": "CE25D189-2D6F-4229-BF09-2CEA0A6C5D50",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_75:*:*:*:*:*:*",
"matchCriteriaId": "36549BE5-DEDB-408A-BFC9-AB00031D45DD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_76:*:*:*:*:*:*",
"matchCriteriaId": "E11B8075-4212-41CB-85AC-09FA1CDB86A1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_78:*:*:*:*:*:*",
"matchCriteriaId": "80412DCE-D79F-492A-8788-6A43C4D76D7C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_79:*:*:*:*:*:*",
"matchCriteriaId": "BC7A939F-21D1-4AF1-BAB9-E91DFCFFB7A2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_80:*:*:*:*:*:*",
"matchCriteriaId": "5F2240FC-EDDC-47F5-B713-07FF2D23CE00",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_81:*:*:*:*:*:*",
"matchCriteriaId": "5006AAE4-B154-468A-850C-20171965E2AC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_82:*:*:*:*:*:*",
"matchCriteriaId": "1541072D-3F14-47A2-8A42-EF2765643AE4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_83:*:*:*:*:*:*",
"matchCriteriaId": "2340C85F-0296-4591-8D23-56634C50C5F8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_84:*:*:*:*:*:*",
"matchCriteriaId": "6BEC3C5C-DA8C-4620-A38E-BB47D4CB7CBA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_85:*:*:*:*:*:*",
"matchCriteriaId": "6DD38B1F-7EEA-4DB5-A31B-D84DC33313FA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_86:*:*:*:*:*:*",
"matchCriteriaId": "FC923A9E-CF9D-44DE-AB58-7BCAAFDDE7D6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_87:*:*:*:*:*:*",
"matchCriteriaId": "65542031-04E1-485F-8102-04CB65865ECE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_88:*:*:*:*:*:*",
"matchCriteriaId": "B36F2FBD-E949-4608-9ECF-0F05DD8E487E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_89:*:*:*:*:*:*",
"matchCriteriaId": "D68832F1-6D71-4A63-AA8A-86C0EDF9F8E1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_90:*:*:*:*:*:*",
"matchCriteriaId": "FD1F579A-084C-46A9-ADCA-8F3FA45D85D6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_91:*:*:*:*:*:*",
"matchCriteriaId": "FC81C494-F68E-4580-87FB-7792C1080DFC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_92:*:*:*:*:*:*",
"matchCriteriaId": "6693594D-6731-4223-8C28-4873746B97AB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_93:*:*:*:*:*:*",
"matchCriteriaId": "0B96CDC5-F4DE-49A2-B09D-318163EC9A09",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_94:*:*:*:*:*:*",
"matchCriteriaId": "EEAE13AF-DEEE-4284-A93D-EFE2647E12FB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_95:*:*:*:*:*:*",
"matchCriteriaId": "9EEADDC3-C436-452F-9271-8F30A9D03FE6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_96:*:*:*:*:*:*",
"matchCriteriaId": "A775E68D-A18E-433F-A9D0-AB6E71495936",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:sp2:*:*:*:*:*:*",
"matchCriteriaId": "10B8AA8F-3EA3-43B4-BD76-F9A52D234043",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:sp5:*:*:*:*:*:*",
"matchCriteriaId": "7C745762-D4B9-4DAB-9A74-7ED4F7591B04",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:-:*:*:*:*:*:*",
"matchCriteriaId": "C2AA7E18-A41B-4F0D-A04F-57C5745D091B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_1:*:*:*:*:*:*",
"matchCriteriaId": "392B783D-620D-4C71-AAA0-848B16964A27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_10:*:*:*:*:*:*",
"matchCriteriaId": "4F5A94E2-22B7-4D2D-A491-29F395E727C5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_11:*:*:*:*:*:*",
"matchCriteriaId": "E9B10908-C42B-4763-9D47-236506B0E84A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_12:*:*:*:*:*:*",
"matchCriteriaId": "CF544435-36AC-49B8-BA50-A6B6D1678BBC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_13:*:*:*:*:*:*",
"matchCriteriaId": "9D265542-5333-4CCD-90E5-B5F6A55F9863",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_14:*:*:*:*:*:*",
"matchCriteriaId": "1763CD8B-3ACD-4617-A1CA-B9F77A074977",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_15:*:*:*:*:*:*",
"matchCriteriaId": "F25C66AA-B60D-413C-A848-51E12D6080AC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_16:*:*:*:*:*:*",
"matchCriteriaId": "071A0D53-EC95-4B18-9FA3-55208B1F7B94",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_17:*:*:*:*:*:*",
"matchCriteriaId": "CC26A9D4-14D6-46B1-BB00-A2C4386EBCA4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_18:*:*:*:*:*:*",
"matchCriteriaId": "350CDEDA-9A20-4BC3-BEAE-8346CED10CD6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_19:*:*:*:*:*:*",
"matchCriteriaId": "10C6107E-79B3-4672-B3E5-8A2FA9A829CF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_2:*:*:*:*:*:*",
"matchCriteriaId": "3233D306-3F8E-40A4-B132-7264E63DD131",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_20:*:*:*:*:*:*",
"matchCriteriaId": "A978B14E-96F6-449F-8D8D-8E782A5A3D19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_21:*:*:*:*:*:*",
"matchCriteriaId": "87600A59-7DD1-49F5-A5A5-EA392193C6A3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_22:*:*:*:*:*:*",
"matchCriteriaId": "33EB9718-E83C-43F4-AFF9-86A83F6F75A4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_3:*:*:*:*:*:*",
"matchCriteriaId": "9EAEA45A-0370-475E-B4CB-395A434DC3A1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_4:*:*:*:*:*:*",
"matchCriteriaId": "39310F05-1DB6-43BA-811C-9CB91D6DCF20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_5:*:*:*:*:*:*",
"matchCriteriaId": "D6135B16-C89E-4F49-BA15-823E2AF26D68",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_6:*:*:*:*:*:*",
"matchCriteriaId": "CC887BEC-915B-44AC-B473-5448B3D8DCF7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_7:*:*:*:*:*:*",
"matchCriteriaId": "D7A7CC60-C294-41EC-B000-D15AAA93A3D5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_8:*:*:*:*:*:*",
"matchCriteriaId": "022132F8-6E56-4A29-95D6-3B7861D39CDF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_9:*:*:*:*:*:*",
"matchCriteriaId": "651DA9B7-9C11-47A7-AF5C-95625C8FFF6A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:-:*:*:*:*:*:*",
"matchCriteriaId": "8CAAE1B7-982E-4D50-9651-DEEE6CD74EED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_1:*:*:*:*:*:*",
"matchCriteriaId": "AFCF99EC-3384-418D-A419-B9DB607BE371",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_10:*:*:*:*:*:*",
"matchCriteriaId": "F7CAAF53-AA8E-48CB-9398-35461BE590C4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_11:*:*:*:*:*:*",
"matchCriteriaId": "6FB8482E-644B-4DA5-808B-8DBEAB6D8D09",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_2:*:*:*:*:*:*",
"matchCriteriaId": "31E05134-A0C5-4937-A228-7D0884276B67",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_3:*:*:*:*:*:*",
"matchCriteriaId": "3F06C4AD-FD20-4345-8386-0895312F0A00",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_4:*:*:*:*:*:*",
"matchCriteriaId": "98CC25E2-EC3D-43A2-8D03-06F0E804EA63",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_5:*:*:*:*:*:*",
"matchCriteriaId": "30933C36-C710-488F-9601-EE1BB749C58A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_6:*:*:*:*:*:*",
"matchCriteriaId": "41E94372-A1AE-48B1-82DC-08B7B616473F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_7:*:*:*:*:*:*",
"matchCriteriaId": "51FBC8E0-34F8-475C-A1A8-571791CA05F9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_8:*:*:*:*:*:*",
"matchCriteriaId": "1E73EAEA-FA88-46B9-B9D5-A41603957AD7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_9:*:*:*:*:*:*",
"matchCriteriaId": "CF9BC654-4E3F-4B40-A6E5-79A818A51BED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.3:-:*:*:*:*:*:*",
"matchCriteriaId": "21C55D41-DB66-494D-BEEB-BDAC7CB4B31B",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in the Portal Workflow module\u0027s edit process page in Liferay DXP 7.0 before fix pack 99, 7.1 before fix pack 23, 7.2 before fix pack 12 and 7.3 before fix pack 1, allows remote attackers to inject arbitrary web script or HTML via the currentURL parameter."
},
{
"lang": "es",
"value": "Una vulnerabilidad de tipo Cross-site scripting (XSS) en la p\u00e1gina de proceso de edici\u00f3n del m\u00f3dulo Portal Workflow en Liferay versiones 7.0 anteriores a fix pack 99, versiones 7.1 anteriores a fix pack 23, versiones 7.2 anteriores a fix pack 12 and versiones 7.3 anteriores a fix pack 1, permite a atacantes remotos inyectar scripts web o HTML arbitrarios por medio del par\u00e1metro currentURL"
}
],
"id": "CVE-2021-29049",
"lastModified": "2024-11-21T06:00:35.773",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2021-06-09T19:15:09.567",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://liferay.com"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://issues.liferay.com/browse/LPE-17211"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://liferay.com"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://issues.liferay.com/browse/LPE-17211"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2021-05-17 11:15
Modified
2024-11-21 06:00
Severity ?
Summary
Cross-site scripting (XSS) vulnerability in the Asset module's category selector input field in Liferay Portal 7.3.5 and Liferay DXP 7.3 before fix pack 1, allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_asset_categories_admin_web_portlet_AssetCategoriesAdminPortlet_title parameter.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| liferay | dxp | 7.3 | |
| liferay | liferay_portal | 7.3.5 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:liferay:dxp:7.3:-:*:*:*:*:*:*",
"matchCriteriaId": "21C55D41-DB66-494D-BEEB-BDAC7CB4B31B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:liferay_portal:7.3.5:*:*:*:*:*:*:*",
"matchCriteriaId": "2B842A08-1EDB-4232-89C9-9B966E251B3B",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in the Asset module\u0027s category selector input field in Liferay Portal 7.3.5 and Liferay DXP 7.3 before fix pack 1, allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_asset_categories_admin_web_portlet_AssetCategoriesAdminPortlet_title parameter."
},
{
"lang": "es",
"value": "Una vulnerabilidad de tipo cross-site scripting (XSS) en el campo de entrada del selector de categor\u00eda del m\u00f3dulo Asset en Liferay Portal versi\u00f3n 7.3.5 y Liferay DXP versiones 7.3 anteriores a fixpack 1, permite a atacantes remotos inyectar un script web o HTML arbitrario por medio del par\u00e1metro _com_liferay_asset_categories_admin_web_portlet_AssetCategoriesAdminPortlet_title"
}
],
"id": "CVE-2021-29046",
"lastModified": "2024-11-21T06:00:35.323",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2021-05-17T11:15:07.277",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://liferay.com"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120743501"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://liferay.com"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120743501"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2022-10-19 02:15
Modified
2024-11-21 07:17
Severity ?
Summary
A Cross-site scripting (XSS) vulnerability in the Document and Media module - file upload functionality in Liferay Digital Experience Platform 7.3.10 SP3 allows remote attackers to inject arbitrary JS script or HTML into the description field of uploaded svg file.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://liferay.com | Vendor Advisory | |
| cve@mitre.org | https://drive.proton.me/urls/D27RQ14NGW#b71d8XrBl2Mu | Third Party Advisory | |
| cve@mitre.org | https://www.offensity.com/en/blog/authenticated-persistent-xss-in-liferay-dxp-cms-cve-2022-38901-and-cve-2022-38902/ | Exploit, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://liferay.com | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://drive.proton.me/urls/D27RQ14NGW#b71d8XrBl2Mu | Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.offensity.com/en/blog/authenticated-persistent-xss-in-liferay-dxp-cms-cve-2022-38901-and-cve-2022-38902/ | Exploit, Third Party Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| liferay | dxp | * | |
| liferay | dxp | 7.3 | |
| liferay | dxp | 7.3 | |
| liferay | dxp | 7.3 | |
| liferay | dxp | 7.3 | |
| liferay | dxp | 7.3 | |
| liferay | dxp | 7.3 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | liferay_portal | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:liferay:dxp:*:*:*:*:*:*:*:*",
"matchCriteriaId": "4A46C2D9-63F5-41D7-A804-8B82093B805A",
"versionEndExcluding": "7.3",
"versionStartIncluding": "7.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.3:-:*:*:*:*:*:*",
"matchCriteriaId": "21C55D41-DB66-494D-BEEB-BDAC7CB4B31B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.3:update_1:*:*:*:*:*:*",
"matchCriteriaId": "D60CDAA3-6029-4904-9D08-BB221BCFD7C3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.3:update_2:*:*:*:*:*:*",
"matchCriteriaId": "B66F47E9-3D82-497E-BD84-E47A65FAF8C3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.3:update_3:*:*:*:*:*:*",
"matchCriteriaId": "A0BA4856-59DF-427C-959F-3B836314F5D5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.3:update_4:*:*:*:*:*:*",
"matchCriteriaId": "F3A5ADE1-4743-4A78-9FCC-CEB857012A5B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.3:update_5:*:*:*:*:*:*",
"matchCriteriaId": "2B420A18-5C8B-470F-9189-C84F8DAA74D5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_1:*:*:*:*:*:*",
"matchCriteriaId": "46AF397F-A95C-4FAD-A6EA-CB623B7A262A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_10:*:*:*:*:*:*",
"matchCriteriaId": "3B8C3B3F-1BBB-47A5-A789-B207B6346FFF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_11:*:*:*:*:*:*",
"matchCriteriaId": "AD5D1171-954A-4E75-813D-E8392CFE4029",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_12:*:*:*:*:*:*",
"matchCriteriaId": "F148098A-D867-4C8B-9632-6B7F24D50C30",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_13:*:*:*:*:*:*",
"matchCriteriaId": "8A112ED2-27C2-45E3-8FA0-6043F7D3BEED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_14:*:*:*:*:*:*",
"matchCriteriaId": "0744AC04-9663-4DA1-9657-EC5BF0C68499",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_15:*:*:*:*:*:*",
"matchCriteriaId": "5703FE2B-011A-4A40-AB67-B989438F2183",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_16:*:*:*:*:*:*",
"matchCriteriaId": "41A54448-B1AB-4E92-8523-5D4A46A83533",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_17:*:*:*:*:*:*",
"matchCriteriaId": "A96A2A4A-3EB3-4074-A846-EC6EECC04B43",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_18:*:*:*:*:*:*",
"matchCriteriaId": "56DAE678-10B9-419D-9F5D-96E3AC3A6E4A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_19:*:*:*:*:*:*",
"matchCriteriaId": "064F4C28-B1F5-44C2-91AA-A09FD56EC0B9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_2:*:*:*:*:*:*",
"matchCriteriaId": "C2C2351E-BDEE-4A79-A00C-6520B54996EF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_20:*:*:*:*:*:*",
"matchCriteriaId": "814D0CE3-B89F-423C-B1E3-47BD0A474491",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_21:*:*:*:*:*:*",
"matchCriteriaId": "58DB7C5A-B4E3-410A-B491-3F322B340BDF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_22:*:*:*:*:*:*",
"matchCriteriaId": "86B581B6-02B0-40B9-BB5C-E28FC51042DB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_23:*:*:*:*:*:*",
"matchCriteriaId": "E7EFBC14-6785-4435-BA96-D77A857BC1C8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_24:*:*:*:*:*:*",
"matchCriteriaId": "585635F8-53DC-4F64-BF6B-C6F72A5F4D29",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_25:*:*:*:*:*:*",
"matchCriteriaId": "355DD7FC-E9C7-43D6-8313-0474AB314F18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_26:*:*:*:*:*:*",
"matchCriteriaId": "B0FDE8B1-444A-4FEB-AC97-4B29C914EB8A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_27:*:*:*:*:*:*",
"matchCriteriaId": "683D063A-0E32-4E2D-8CBF-A57F45071F6E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_28:*:*:*:*:*:*",
"matchCriteriaId": "7DFEBCAB-1D9B-4BED-A2C6-11BA863F1EE9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_3:*:*:*:*:*:*",
"matchCriteriaId": "25F5C3E9-CBB0-4114-91A4-41F0E666026A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_4:*:*:*:*:*:*",
"matchCriteriaId": "5E2B5687-B311-460E-A562-D754AF271F8E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_5:*:*:*:*:*:*",
"matchCriteriaId": "B49D0CB9-8ED7-46AB-9BA5-7235A2CD9117",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_6:*:*:*:*:*:*",
"matchCriteriaId": "DF169364-096C-4294-B89F-C07AF1DCC9C4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_7:*:*:*:*:*:*",
"matchCriteriaId": "30CB2C54-1A20-4226-ACC6-AC8131899AE2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_8:*:*:*:*:*:*",
"matchCriteriaId": "65693260-5B0F-47AA-BF08-D2979997A40A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_9:*:*:*:*:*:*",
"matchCriteriaId": "C9116909-04C3-4040-B945-4A6225425520",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:*",
"matchCriteriaId": "C0FF0E3A-B8C0-4867-9702-86F17ED4555A",
"versionEndIncluding": "7.4.3.28",
"versionStartIncluding": "7.3.5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A Cross-site scripting (XSS) vulnerability in the Document and Media module - file upload functionality in Liferay Digital Experience Platform 7.3.10 SP3 allows remote attackers to inject arbitrary JS script or HTML into the description field of uploaded svg file."
},
{
"lang": "es",
"value": "Una vulnerabilidad de tipo Cross-site scripting (XSS) en el m\u00f3dulo Document and Media - funcionalidad de descarga de archivos en Liferay Digital Experience Platform versi\u00f3n 7.3.10 SP3, permite a atacantes remotos inyectar scripts JS o HTML arbitrarias en el campo description del archivo svg descargado"
}
],
"id": "CVE-2022-38901",
"lastModified": "2024-11-21T07:17:15.060",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.3,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2022-10-19T02:15:09.000",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://liferay.com"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "https://drive.proton.me/urls/D27RQ14NGW#b71d8XrBl2Mu"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://www.offensity.com/en/blog/authenticated-persistent-xss-in-liferay-dxp-cms-cve-2022-38901-and-cve-2022-38902/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://liferay.com"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://drive.proton.me/urls/D27RQ14NGW#b71d8XrBl2Mu"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://www.offensity.com/en/blog/authenticated-persistent-xss-in-liferay-dxp-cms-cve-2022-38901-and-cve-2022-38902/"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2024-02-08 04:15
Modified
2024-11-21 09:00
Severity ?
4.1 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:N/A:L
6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Summary
The IFrame widget in Liferay Portal 7.2.0 through 7.4.3.26, and older unsupported versions, and Liferay DXP 7.4 before update 27, 7.3 before update 6, 7.2 before fix pack 19, and older unsupported versions does not check the URL of the IFrame, which allows remote authenticated users to cause a denial-of-service (DoS) via a self referencing IFrame.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.3 | |
| liferay | dxp | 7.3 | |
| liferay | dxp | 7.3 | |
| liferay | dxp | 7.3 | |
| liferay | dxp | 7.3 | |
| liferay | dxp | 7.3 | |
| liferay | dxp | 7.3 | |
| liferay | dxp | 7.3 | |
| liferay | dxp | 7.3 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | liferay_portal | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:-:*:*:*:*:*:*",
"matchCriteriaId": "8CAAE1B7-982E-4D50-9651-DEEE6CD74EED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_1:*:*:*:*:*:*",
"matchCriteriaId": "AFCF99EC-3384-418D-A419-B9DB607BE371",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_10:*:*:*:*:*:*",
"matchCriteriaId": "F7CAAF53-AA8E-48CB-9398-35461BE590C4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_11:*:*:*:*:*:*",
"matchCriteriaId": "6FB8482E-644B-4DA5-808B-8DBEAB6D8D09",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_12:*:*:*:*:*:*",
"matchCriteriaId": "95EFE8B5-EE95-4186-AC89-E9AFD8649D01",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_13:*:*:*:*:*:*",
"matchCriteriaId": "90A6E0AF-0B8A-462D-95EF-2239EEE4A50D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_14:*:*:*:*:*:*",
"matchCriteriaId": "48BBAE90-F668-49BF-89AF-2C9547B76836",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_15:*:*:*:*:*:*",
"matchCriteriaId": "74FAF597-EAAD-4BB5-AB99-8129476A7E89",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_16:*:*:*:*:*:*",
"matchCriteriaId": "20F078A3-A3EE-4CCA-816D-3C053E7D7FE3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_17:*:*:*:*:*:*",
"matchCriteriaId": "C33EBD80-91DD-401C-9337-171C07B5D489",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_18:*:*:*:*:*:*",
"matchCriteriaId": "0058B9A5-7864-4356-ADBA-C9AF1BB74836",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_2:*:*:*:*:*:*",
"matchCriteriaId": "31E05134-A0C5-4937-A228-7D0884276B67",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_3:*:*:*:*:*:*",
"matchCriteriaId": "3F06C4AD-FD20-4345-8386-0895312F0A00",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_4:*:*:*:*:*:*",
"matchCriteriaId": "98CC25E2-EC3D-43A2-8D03-06F0E804EA63",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_5:*:*:*:*:*:*",
"matchCriteriaId": "30933C36-C710-488F-9601-EE1BB749C58A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_6:*:*:*:*:*:*",
"matchCriteriaId": "41E94372-A1AE-48B1-82DC-08B7B616473F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_7:*:*:*:*:*:*",
"matchCriteriaId": "51FBC8E0-34F8-475C-A1A8-571791CA05F9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_8:*:*:*:*:*:*",
"matchCriteriaId": "1E73EAEA-FA88-46B9-B9D5-A41603957AD7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_9:*:*:*:*:*:*",
"matchCriteriaId": "CF9BC654-4E3F-4B40-A6E5-79A818A51BED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.3:-:*:*:*:*:*:*",
"matchCriteriaId": "21C55D41-DB66-494D-BEEB-BDAC7CB4B31B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.3:sp1:*:*:*:*:*:*",
"matchCriteriaId": "9D75A0FF-BAEA-471A-87B2-8EC2A9F0A6B5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.3:sp2:*:*:*:*:*:*",
"matchCriteriaId": "D86CDCC0-9655-477B-83FA-ADDBB5AF43A2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.3:sp3:*:*:*:*:*:*",
"matchCriteriaId": "1CF5B84B-1719-4581-8474-C55CEFFD8305",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.3:update_1:*:*:*:*:*:*",
"matchCriteriaId": "D60CDAA3-6029-4904-9D08-BB221BCFD7C3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.3:update_2:*:*:*:*:*:*",
"matchCriteriaId": "B66F47E9-3D82-497E-BD84-E47A65FAF8C3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.3:update_3:*:*:*:*:*:*",
"matchCriteriaId": "A0BA4856-59DF-427C-959F-3B836314F5D5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.3:update_4:*:*:*:*:*:*",
"matchCriteriaId": "F3A5ADE1-4743-4A78-9FCC-CEB857012A5B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.3:update_5:*:*:*:*:*:*",
"matchCriteriaId": "2B420A18-5C8B-470F-9189-C84F8DAA74D5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:-:*:*:*:*:*:*",
"matchCriteriaId": "ADB5F13C-EE1E-4448-8FCF-5966F6874440",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_1:*:*:*:*:*:*",
"matchCriteriaId": "46AF397F-A95C-4FAD-A6EA-CB623B7A262A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_10:*:*:*:*:*:*",
"matchCriteriaId": "3B8C3B3F-1BBB-47A5-A789-B207B6346FFF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_11:*:*:*:*:*:*",
"matchCriteriaId": "AD5D1171-954A-4E75-813D-E8392CFE4029",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_12:*:*:*:*:*:*",
"matchCriteriaId": "F148098A-D867-4C8B-9632-6B7F24D50C30",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_13:*:*:*:*:*:*",
"matchCriteriaId": "8A112ED2-27C2-45E3-8FA0-6043F7D3BEED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_14:*:*:*:*:*:*",
"matchCriteriaId": "0744AC04-9663-4DA1-9657-EC5BF0C68499",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_15:*:*:*:*:*:*",
"matchCriteriaId": "5703FE2B-011A-4A40-AB67-B989438F2183",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_16:*:*:*:*:*:*",
"matchCriteriaId": "41A54448-B1AB-4E92-8523-5D4A46A83533",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_17:*:*:*:*:*:*",
"matchCriteriaId": "A96A2A4A-3EB3-4074-A846-EC6EECC04B43",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_18:*:*:*:*:*:*",
"matchCriteriaId": "56DAE678-10B9-419D-9F5D-96E3AC3A6E4A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_19:*:*:*:*:*:*",
"matchCriteriaId": "064F4C28-B1F5-44C2-91AA-A09FD56EC0B9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_2:*:*:*:*:*:*",
"matchCriteriaId": "C2C2351E-BDEE-4A79-A00C-6520B54996EF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_20:*:*:*:*:*:*",
"matchCriteriaId": "814D0CE3-B89F-423C-B1E3-47BD0A474491",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_21:*:*:*:*:*:*",
"matchCriteriaId": "58DB7C5A-B4E3-410A-B491-3F322B340BDF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_22:*:*:*:*:*:*",
"matchCriteriaId": "86B581B6-02B0-40B9-BB5C-E28FC51042DB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_23:*:*:*:*:*:*",
"matchCriteriaId": "E7EFBC14-6785-4435-BA96-D77A857BC1C8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_24:*:*:*:*:*:*",
"matchCriteriaId": "585635F8-53DC-4F64-BF6B-C6F72A5F4D29",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_25:*:*:*:*:*:*",
"matchCriteriaId": "355DD7FC-E9C7-43D6-8313-0474AB314F18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_26:*:*:*:*:*:*",
"matchCriteriaId": "B0FDE8B1-444A-4FEB-AC97-4B29C914EB8A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_3:*:*:*:*:*:*",
"matchCriteriaId": "25F5C3E9-CBB0-4114-91A4-41F0E666026A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_4:*:*:*:*:*:*",
"matchCriteriaId": "5E2B5687-B311-460E-A562-D754AF271F8E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_5:*:*:*:*:*:*",
"matchCriteriaId": "B49D0CB9-8ED7-46AB-9BA5-7235A2CD9117",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_6:*:*:*:*:*:*",
"matchCriteriaId": "DF169364-096C-4294-B89F-C07AF1DCC9C4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_7:*:*:*:*:*:*",
"matchCriteriaId": "30CB2C54-1A20-4226-ACC6-AC8131899AE2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_8:*:*:*:*:*:*",
"matchCriteriaId": "65693260-5B0F-47AA-BF08-D2979997A40A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_9:*:*:*:*:*:*",
"matchCriteriaId": "C9116909-04C3-4040-B945-4A6225425520",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:*",
"matchCriteriaId": "71EF9A3C-C47A-4C68-B7FA-39AA7F20B8BD",
"versionEndExcluding": "7.4.3.26",
"versionStartIncluding": "7.2.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The IFrame widget in Liferay Portal 7.2.0 through 7.4.3.26, and older unsupported versions, and Liferay DXP 7.4 before update 27, 7.3 before update 6, 7.2 before fix pack 19, and older unsupported versions does not check the URL of the IFrame, which allows remote authenticated users to cause a denial-of-service (DoS) via a self referencing IFrame."
},
{
"lang": "es",
"value": "El widget IFrame en Liferay Portal 7.2.0 a 7.4.3.26 y versiones anteriores no compatibles, y Liferay DXP 7.4 antes de la actualizaci\u00f3n 27, 7.3 antes de la actualizaci\u00f3n 6, 7.2 antes del fixpack 19 y versiones anteriores no compatibles no comprueba la URL del IFrame , que permite a los usuarios autenticados remotamente provocar una denegaci\u00f3n de servicio (DoS) a trav\u00e9s de un IFrame de autorreferencia."
}
],
"id": "CVE-2024-25144",
"lastModified": "2024-11-21T09:00:20.550",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 4.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:N/A:L",
"version": "3.1"
},
"exploitabilityScore": 2.3,
"impactScore": 1.4,
"source": "security@liferay.com",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2024-02-08T04:15:07.763",
"references": [
{
"source": "security@liferay.com",
"tags": [
"Vendor Advisory"
],
"url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25144"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25144"
}
],
"sourceIdentifier": "security@liferay.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-835"
}
],
"source": "security@liferay.com",
"type": "Secondary"
},
{
"description": [
{
"lang": "en",
"value": "CWE-834"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2021-08-04 14:15
Modified
2024-11-21 06:08
Severity ?
Summary
The Layout module in Liferay Portal 7.1.0 through 7.3.2, and Liferay DXP 7.1 before fix pack 19, and 7.2 before fix pack 6, exposes the CSRF token in URLs, which allows man-in-the-middle attackers to obtain the token and conduct Cross-Site Request Forgery (CSRF) attacks via the p_auth parameter.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | https://issues.liferay.com/browse/LPE-17030 | Issue Tracking, Vendor Advisory | |
| cve@mitre.org | https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120748276 | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://issues.liferay.com/browse/LPE-17030 | Issue Tracking, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120748276 | Vendor Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | liferay_portal | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:-:*:*:*:*:*:*",
"matchCriteriaId": "C2AA7E18-A41B-4F0D-A04F-57C5745D091B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_1:*:*:*:*:*:*",
"matchCriteriaId": "392B783D-620D-4C71-AAA0-848B16964A27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_10:*:*:*:*:*:*",
"matchCriteriaId": "4F5A94E2-22B7-4D2D-A491-29F395E727C5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_11:*:*:*:*:*:*",
"matchCriteriaId": "E9B10908-C42B-4763-9D47-236506B0E84A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_12:*:*:*:*:*:*",
"matchCriteriaId": "CF544435-36AC-49B8-BA50-A6B6D1678BBC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_13:*:*:*:*:*:*",
"matchCriteriaId": "9D265542-5333-4CCD-90E5-B5F6A55F9863",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_14:*:*:*:*:*:*",
"matchCriteriaId": "1763CD8B-3ACD-4617-A1CA-B9F77A074977",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_15:*:*:*:*:*:*",
"matchCriteriaId": "F25C66AA-B60D-413C-A848-51E12D6080AC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_16:*:*:*:*:*:*",
"matchCriteriaId": "071A0D53-EC95-4B18-9FA3-55208B1F7B94",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_17:*:*:*:*:*:*",
"matchCriteriaId": "CC26A9D4-14D6-46B1-BB00-A2C4386EBCA4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_18:*:*:*:*:*:*",
"matchCriteriaId": "350CDEDA-9A20-4BC3-BEAE-8346CED10CD6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_2:*:*:*:*:*:*",
"matchCriteriaId": "3233D306-3F8E-40A4-B132-7264E63DD131",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_3:*:*:*:*:*:*",
"matchCriteriaId": "9EAEA45A-0370-475E-B4CB-395A434DC3A1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_4:*:*:*:*:*:*",
"matchCriteriaId": "39310F05-1DB6-43BA-811C-9CB91D6DCF20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_5:*:*:*:*:*:*",
"matchCriteriaId": "D6135B16-C89E-4F49-BA15-823E2AF26D68",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_6:*:*:*:*:*:*",
"matchCriteriaId": "CC887BEC-915B-44AC-B473-5448B3D8DCF7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_7:*:*:*:*:*:*",
"matchCriteriaId": "D7A7CC60-C294-41EC-B000-D15AAA93A3D5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_8:*:*:*:*:*:*",
"matchCriteriaId": "022132F8-6E56-4A29-95D6-3B7861D39CDF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_9:*:*:*:*:*:*",
"matchCriteriaId": "651DA9B7-9C11-47A7-AF5C-95625C8FFF6A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:-:*:*:*:*:*:*",
"matchCriteriaId": "8CAAE1B7-982E-4D50-9651-DEEE6CD74EED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_1:*:*:*:*:*:*",
"matchCriteriaId": "AFCF99EC-3384-418D-A419-B9DB607BE371",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_2:*:*:*:*:*:*",
"matchCriteriaId": "31E05134-A0C5-4937-A228-7D0884276B67",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_3:*:*:*:*:*:*",
"matchCriteriaId": "3F06C4AD-FD20-4345-8386-0895312F0A00",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_4:*:*:*:*:*:*",
"matchCriteriaId": "98CC25E2-EC3D-43A2-8D03-06F0E804EA63",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_5:*:*:*:*:*:*",
"matchCriteriaId": "30933C36-C710-488F-9601-EE1BB749C58A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:*",
"matchCriteriaId": "3196CFB1-2DEB-4546-A8DE-75F9DF500000",
"versionEndIncluding": "7.3.2",
"versionStartIncluding": "7.1.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The Layout module in Liferay Portal 7.1.0 through 7.3.2, and Liferay DXP 7.1 before fix pack 19, and 7.2 before fix pack 6, exposes the CSRF token in URLs, which allows man-in-the-middle attackers to obtain the token and conduct Cross-Site Request Forgery (CSRF) attacks via the p_auth parameter."
},
{
"lang": "es",
"value": "El m\u00f3dulo Layout en Liferay Portal versiones 7.1.0 hasta 7.3.2, y Liferay DXP versiones 7.1 anteriores a fix pack 19, y versiones 7.2 anteriores a fix pack 6, expone el token CSRF en las URLs, lo que permite a atacantes de tipo man-in-the-middle obtener el token y llevar a cabo ataques de tipo Cross-Site Request Forgery (CSRF) por medio del par\u00e1metro p_auth"
}
],
"id": "CVE-2021-33338",
"lastModified": "2024-11-21T06:08:43.580",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "HIGH",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 5.1,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:H/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 4.9,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.6,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2021-08-04T14:15:08.347",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Issue Tracking",
"Vendor Advisory"
],
"url": "https://issues.liferay.com/browse/LPE-17030"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120748276"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Issue Tracking",
"Vendor Advisory"
],
"url": "https://issues.liferay.com/browse/LPE-17030"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120748276"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-352"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2022-11-15 01:15
Modified
2024-11-21 07:24
Severity ?
Summary
A SQL injection vulnerability in the Fragment module in Liferay Portal 7.3.3 through 7.4.3.16, and Liferay DXP 7.3 before update 4, and 7.4 before update 17 allows attackers to execute arbitrary SQL commands via a PortletPreferences' `namespace` attribute.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://liferay.com | Vendor Advisory | |
| cve@mitre.org | https://issues.liferay.com/browse/LPE-17513 | Issue Tracking, Vendor Advisory | |
| cve@mitre.org | https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42120 | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://liferay.com | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://issues.liferay.com/browse/LPE-17513 | Issue Tracking, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42120 | Vendor Advisory |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:liferay:dxp:7.3:-:*:*:*:*:*:*",
"matchCriteriaId": "21C55D41-DB66-494D-BEEB-BDAC7CB4B31B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:-:*:*:*:*:*:*",
"matchCriteriaId": "ADB5F13C-EE1E-4448-8FCF-5966F6874440",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:*",
"matchCriteriaId": "E0A4BD58-ACF2-416E-A1B1-447DDD001B54",
"versionEndIncluding": "7.4.3.16",
"versionStartIncluding": "7.3.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A SQL injection vulnerability in the Fragment module in Liferay Portal 7.3.3 through 7.4.3.16, and Liferay DXP 7.3 before update 4, and 7.4 before update 17 allows attackers to execute arbitrary SQL commands via a PortletPreferences\u0027 `namespace` attribute."
},
{
"lang": "es",
"value": "Una vulnerabilidad de inyecci\u00f3n SQL en el m\u00f3dulo Fragment en Liferay Portal 7.3.3 a 7.4.3.16, y Liferay DXP 7.3 antes de la actualizaci\u00f3n 4, y 7.4 antes de la actualizaci\u00f3n 17 permite a los atacantes ejecutar comandos SQL arbitrarios a trav\u00e9s del atributo `namespace` de PortletPreferences."
}
],
"id": "CVE-2022-42120",
"lastModified": "2024-11-21T07:24:24.070",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2022-11-15T01:15:12.733",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://liferay.com"
},
{
"source": "cve@mitre.org",
"tags": [
"Issue Tracking",
"Vendor Advisory"
],
"url": "https://issues.liferay.com/browse/LPE-17513"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42120"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://liferay.com"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Issue Tracking",
"Vendor Advisory"
],
"url": "https://issues.liferay.com/browse/LPE-17513"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42120"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-89"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2021-05-17 11:15
Modified
2024-11-21 06:00
Severity ?
Summary
Cross-site scripting (XSS) vulnerability in the Redirect module's redirection administration page in Liferay Portal 7.3.2 through 7.3.5, and Liferay DXP 7.3 before fix pack 1 allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_redirect_web_internal_portlet_RedirectPortlet_destinationURL parameter.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| liferay | dxp | 7.3 | |
| liferay | liferay_portal | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:liferay:dxp:7.3:-:*:*:*:*:*:*",
"matchCriteriaId": "21C55D41-DB66-494D-BEEB-BDAC7CB4B31B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:*",
"matchCriteriaId": "A622610B-E145-43E4-AFC6-A4A196296301",
"versionEndIncluding": "7.3.5",
"versionStartIncluding": "7.3.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in the Redirect module\u0027s redirection administration page in Liferay Portal 7.3.2 through 7.3.5, and Liferay DXP 7.3 before fix pack 1 allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_redirect_web_internal_portlet_RedirectPortlet_destinationURL parameter."
},
{
"lang": "es",
"value": "Una vulnerabilidad de tipo cross-site scripting (XSS) en la p\u00e1gina de administraci\u00f3n de redireccionamiento del m\u00f3dulo Redirect en Liferay Portal versiones 7.3.2 hasta 7.3.5, y Liferay DXP versiones 7.3 anteriores a fixpack 1, permite a atacantes remotos inyectar un script web o HTML arbitrario por medio del par\u00e1metro _com_liferay_redirect_web_internal_portlet_RedirectPortlet_destinationURL"
}
],
"id": "CVE-2021-29045",
"lastModified": "2024-11-21T06:00:35.187",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2021-05-17T11:15:07.243",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://liferay.com"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120743484"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://liferay.com"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120743484"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2021-08-03 22:15
Modified
2024-11-21 06:08
Severity ?
Summary
Privilege escalation vulnerability in Liferay Portal 7.0.3 through 7.3.4, and Liferay DXP 7.1 before fix pack 20, and 7.2 before fix pack 9 allows remote authenticated users with permission to update/edit users to take over a company administrator user account by editing the company administrator user.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | https://issues.liferay.com/browse/LPE-17103 | Issue Tracking, Patch, Vendor Advisory | |
| cve@mitre.org | https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120747906 | Release Notes, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://issues.liferay.com/browse/LPE-17103 | Issue Tracking, Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120747906 | Release Notes, Vendor Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | liferay_portal | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:-:*:*:*:*:*:*",
"matchCriteriaId": "C2AA7E18-A41B-4F0D-A04F-57C5745D091B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_1:*:*:*:*:*:*",
"matchCriteriaId": "392B783D-620D-4C71-AAA0-848B16964A27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_10:*:*:*:*:*:*",
"matchCriteriaId": "4F5A94E2-22B7-4D2D-A491-29F395E727C5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_11:*:*:*:*:*:*",
"matchCriteriaId": "E9B10908-C42B-4763-9D47-236506B0E84A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_12:*:*:*:*:*:*",
"matchCriteriaId": "CF544435-36AC-49B8-BA50-A6B6D1678BBC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_13:*:*:*:*:*:*",
"matchCriteriaId": "9D265542-5333-4CCD-90E5-B5F6A55F9863",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_14:*:*:*:*:*:*",
"matchCriteriaId": "1763CD8B-3ACD-4617-A1CA-B9F77A074977",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_15:*:*:*:*:*:*",
"matchCriteriaId": "F25C66AA-B60D-413C-A848-51E12D6080AC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_16:*:*:*:*:*:*",
"matchCriteriaId": "071A0D53-EC95-4B18-9FA3-55208B1F7B94",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_17:*:*:*:*:*:*",
"matchCriteriaId": "CC26A9D4-14D6-46B1-BB00-A2C4386EBCA4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_18:*:*:*:*:*:*",
"matchCriteriaId": "350CDEDA-9A20-4BC3-BEAE-8346CED10CD6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_19:*:*:*:*:*:*",
"matchCriteriaId": "10C6107E-79B3-4672-B3E5-8A2FA9A829CF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_2:*:*:*:*:*:*",
"matchCriteriaId": "3233D306-3F8E-40A4-B132-7264E63DD131",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_3:*:*:*:*:*:*",
"matchCriteriaId": "9EAEA45A-0370-475E-B4CB-395A434DC3A1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_4:*:*:*:*:*:*",
"matchCriteriaId": "39310F05-1DB6-43BA-811C-9CB91D6DCF20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_5:*:*:*:*:*:*",
"matchCriteriaId": "D6135B16-C89E-4F49-BA15-823E2AF26D68",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_6:*:*:*:*:*:*",
"matchCriteriaId": "CC887BEC-915B-44AC-B473-5448B3D8DCF7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_7:*:*:*:*:*:*",
"matchCriteriaId": "D7A7CC60-C294-41EC-B000-D15AAA93A3D5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_8:*:*:*:*:*:*",
"matchCriteriaId": "022132F8-6E56-4A29-95D6-3B7861D39CDF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_9:*:*:*:*:*:*",
"matchCriteriaId": "651DA9B7-9C11-47A7-AF5C-95625C8FFF6A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:-:*:*:*:*:*:*",
"matchCriteriaId": "8CAAE1B7-982E-4D50-9651-DEEE6CD74EED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_1:*:*:*:*:*:*",
"matchCriteriaId": "AFCF99EC-3384-418D-A419-B9DB607BE371",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_2:*:*:*:*:*:*",
"matchCriteriaId": "31E05134-A0C5-4937-A228-7D0884276B67",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_3:*:*:*:*:*:*",
"matchCriteriaId": "3F06C4AD-FD20-4345-8386-0895312F0A00",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_4:*:*:*:*:*:*",
"matchCriteriaId": "98CC25E2-EC3D-43A2-8D03-06F0E804EA63",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_5:*:*:*:*:*:*",
"matchCriteriaId": "30933C36-C710-488F-9601-EE1BB749C58A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_6:*:*:*:*:*:*",
"matchCriteriaId": "41E94372-A1AE-48B1-82DC-08B7B616473F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_7:*:*:*:*:*:*",
"matchCriteriaId": "51FBC8E0-34F8-475C-A1A8-571791CA05F9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_8:*:*:*:*:*:*",
"matchCriteriaId": "1E73EAEA-FA88-46B9-B9D5-A41603957AD7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:*",
"matchCriteriaId": "00C7CB5F-BB2C-4D9A-8AEF-1DA5AD3E307F",
"versionEndExcluding": "7.3.5",
"versionStartIncluding": "7.0.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Privilege escalation vulnerability in Liferay Portal 7.0.3 through 7.3.4, and Liferay DXP 7.1 before fix pack 20, and 7.2 before fix pack 9 allows remote authenticated users with permission to update/edit users to take over a company administrator user account by editing the company administrator user."
},
{
"lang": "es",
"value": "Una vulnerabilidad de escalada de privilegios en Liferay Portal versiones 7.0.3 hasta 7.3.4, y Liferay DXP versiones 7.1 anteriores a fix pack 20, y versiones 7.2 anteriores a fix pack 9, permite a usuarios autenticados remotos con permiso para actualizar y editar a usuarios tomar el control de una cuenta de usuario de administrador de la empresa al editar al usuario administrador de la empresa"
}
],
"id": "CVE-2021-33335",
"lastModified": "2024-11-21T06:08:43.100",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 8.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.2,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2021-08-03T22:15:09.137",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Issue Tracking",
"Patch",
"Vendor Advisory"
],
"url": "https://issues.liferay.com/browse/LPE-17103"
},
{
"source": "cve@mitre.org",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120747906"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Issue Tracking",
"Patch",
"Vendor Advisory"
],
"url": "https://issues.liferay.com/browse/LPE-17103"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120747906"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-863"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2022-09-22 00:15
Modified
2024-11-21 06:58
Severity ?
Summary
Stored cross-site scripting (XSS) vulnerability in the Site module's user membership administration page in Liferay Portal 7.0.1 through 7.4.1, and Liferay DXP 7.0 before fix pack 102, 7.1 before fix pack 26, 7.2 before fix pack 15, and 7.3 before service pack 3 allows remote attackers to inject arbitrary web script or HTML via the a user's name.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:-:*:*:*:*:*:*",
"matchCriteriaId": "43A92274-7D88-4F0F-8265-CF862011F27F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_100:*:*:*:*:*:*",
"matchCriteriaId": "410D1A51-448F-4E98-BC20-8AB63E4008A7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_101:*:*:*:*:*:*",
"matchCriteriaId": "614C805B-94C4-4486-B791-59DAB1906EB9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_13:*:*:*:*:*:*",
"matchCriteriaId": "4874012D-52AA-4C32-95E9-BD331225B4E6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_14:*:*:*:*:*:*",
"matchCriteriaId": "21CAF86F-CEC9-44EE-BAF8-0F7AF9D945F5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_24:*:*:*:*:*:*",
"matchCriteriaId": "EF6C9F29-EEFF-4737-BD50-58572D6C14E9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_25:*:*:*:*:*:*",
"matchCriteriaId": "D24E1FA0-BD94-4AFC-92BF-AEDEBC7DCF4B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_26:*:*:*:*:*:*",
"matchCriteriaId": "FF9B54EE-973B-44B4-8EA2-B58FA49AC561",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_27:*:*:*:*:*:*",
"matchCriteriaId": "A9637223-557D-474B-A46B-D276866376C3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_28:*:*:*:*:*:*",
"matchCriteriaId": "F6306F9C-99DE-4F94-8E7F-6747762BEC45",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_30:*:*:*:*:*:*",
"matchCriteriaId": "48B7015C-26B9-453E-B3CF-9B220D3A8024",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_33:*:*:*:*:*:*",
"matchCriteriaId": "0FEB6921-3C45-4B7E-8B34-CDC34984583D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_35:*:*:*:*:*:*",
"matchCriteriaId": "525F45DC-2E5C-46A8-AEDF-9D6B8FA2EB11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_36:*:*:*:*:*:*",
"matchCriteriaId": "55755D0C-4C0C-42D9-BE5E-5D33C8BA4C7F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_39:*:*:*:*:*:*",
"matchCriteriaId": "FB4FE0F9-EB19-45D7-A953-674629D951F5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_40:*:*:*:*:*:*",
"matchCriteriaId": "22E4B63F-01A9-4F85-92BC-A51F41BE4121",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_41:*:*:*:*:*:*",
"matchCriteriaId": "23BE441D-8770-4F4D-86CD-4E53161F54FB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_42:*:*:*:*:*:*",
"matchCriteriaId": "E14FF010-3907-4C79-B945-C792E446CB31",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_43:*:*:*:*:*:*",
"matchCriteriaId": "B97B5817-B55E-485D-9747-3A50CF7245C8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_44:*:*:*:*:*:*",
"matchCriteriaId": "19EBD671-56BD-45D3-9248-DAF3F47B36FD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_45:*:*:*:*:*:*",
"matchCriteriaId": "93EDC2A1-9622-44DB-ABA8-754D61B60787",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_46:*:*:*:*:*:*",
"matchCriteriaId": "B4B6A06D-C323-431C-9A65-4FD6A6E4CAB6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_47:*:*:*:*:*:*",
"matchCriteriaId": "EE6D4466-1C3A-4D5A-A65C-A30A87EADF1A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_48:*:*:*:*:*:*",
"matchCriteriaId": "4F0BC40A-8E13-4665-A2E4-F5815CA70E17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_49:*:*:*:*:*:*",
"matchCriteriaId": "11FB69C3-7755-495A-AB76-201AF4D9623B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_50:*:*:*:*:*:*",
"matchCriteriaId": "FF66F652-6C08-4D47-865D-36E70360B632",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_51:*:*:*:*:*:*",
"matchCriteriaId": "17B68D59-0509-4C6A-B803-03A02EB76F1F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_52:*:*:*:*:*:*",
"matchCriteriaId": "8F69B287-3B86-4B64-BCB4-40E9495A628D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_53:*:*:*:*:*:*",
"matchCriteriaId": "C627090E-A1BF-4332-9538-EE4E184DB65E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_54:*:*:*:*:*:*",
"matchCriteriaId": "9A089471-9944-4C75-A25F-1F23C18C0CF0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_56:*:*:*:*:*:*",
"matchCriteriaId": "B90E7FBF-6B5B-457A-8B20-ECA69A626BB8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_57:*:*:*:*:*:*",
"matchCriteriaId": "1975C1AB-EF50-42E2-9879-17FB763B45F9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_58:*:*:*:*:*:*",
"matchCriteriaId": "DFB7BB13-773B-47A6-A001-B9EBA46C917E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_59:*:*:*:*:*:*",
"matchCriteriaId": "1C4A2D39-3725-4E80-9F3F-AC1F4EE662E8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_60:*:*:*:*:*:*",
"matchCriteriaId": "BAEDF88B-B9C8-4891-B199-A72C066FC7BF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_61:*:*:*:*:*:*",
"matchCriteriaId": "F768E1DD-3DC6-4783-82DE-D089C7CD3C63",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_64:*:*:*:*:*:*",
"matchCriteriaId": "426EDA92-FE5A-4523-8AAE-1E5D5D67F535",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_65:*:*:*:*:*:*",
"matchCriteriaId": "070CB609-6D4B-4817-9F91-00BD62423E56",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_66:*:*:*:*:*:*",
"matchCriteriaId": "FEE87846-A4CF-47E5-93AA-5D7E2548D28D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_67:*:*:*:*:*:*",
"matchCriteriaId": "A4C11B0E-6D94-4A65-83BE-1E5828710CB9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_68:*:*:*:*:*:*",
"matchCriteriaId": "F1DC73B1-4017-424F-A28D-F54F2FA8ED8C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_69:*:*:*:*:*:*",
"matchCriteriaId": "32B4FD3C-7BB7-4DA2-9A3A-05A6370B9745",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_70:*:*:*:*:*:*",
"matchCriteriaId": "71293E5B-4DCC-47BC-A493-3540D57E6067",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_71:*:*:*:*:*:*",
"matchCriteriaId": "56A8940B-318E-4C6A-9131-A50E90E82C28",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_72:*:*:*:*:*:*",
"matchCriteriaId": "F09B5E82-DC18-4B07-9A05-E433579B4FB5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_73:*:*:*:*:*:*",
"matchCriteriaId": "CE25D189-2D6F-4229-BF09-2CEA0A6C5D50",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_75:*:*:*:*:*:*",
"matchCriteriaId": "36549BE5-DEDB-408A-BFC9-AB00031D45DD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_76:*:*:*:*:*:*",
"matchCriteriaId": "E11B8075-4212-41CB-85AC-09FA1CDB86A1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_78:*:*:*:*:*:*",
"matchCriteriaId": "80412DCE-D79F-492A-8788-6A43C4D76D7C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_79:*:*:*:*:*:*",
"matchCriteriaId": "BC7A939F-21D1-4AF1-BAB9-E91DFCFFB7A2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_80:*:*:*:*:*:*",
"matchCriteriaId": "5F2240FC-EDDC-47F5-B713-07FF2D23CE00",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_81:*:*:*:*:*:*",
"matchCriteriaId": "5006AAE4-B154-468A-850C-20171965E2AC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_82:*:*:*:*:*:*",
"matchCriteriaId": "1541072D-3F14-47A2-8A42-EF2765643AE4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_83:*:*:*:*:*:*",
"matchCriteriaId": "2340C85F-0296-4591-8D23-56634C50C5F8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_84:*:*:*:*:*:*",
"matchCriteriaId": "6BEC3C5C-DA8C-4620-A38E-BB47D4CB7CBA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_85:*:*:*:*:*:*",
"matchCriteriaId": "6DD38B1F-7EEA-4DB5-A31B-D84DC33313FA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_86:*:*:*:*:*:*",
"matchCriteriaId": "FC923A9E-CF9D-44DE-AB58-7BCAAFDDE7D6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_87:*:*:*:*:*:*",
"matchCriteriaId": "65542031-04E1-485F-8102-04CB65865ECE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_88:*:*:*:*:*:*",
"matchCriteriaId": "B36F2FBD-E949-4608-9ECF-0F05DD8E487E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_89:*:*:*:*:*:*",
"matchCriteriaId": "D68832F1-6D71-4A63-AA8A-86C0EDF9F8E1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_90:*:*:*:*:*:*",
"matchCriteriaId": "FD1F579A-084C-46A9-ADCA-8F3FA45D85D6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_91:*:*:*:*:*:*",
"matchCriteriaId": "FC81C494-F68E-4580-87FB-7792C1080DFC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_92:*:*:*:*:*:*",
"matchCriteriaId": "6693594D-6731-4223-8C28-4873746B97AB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_93:*:*:*:*:*:*",
"matchCriteriaId": "0B96CDC5-F4DE-49A2-B09D-318163EC9A09",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_94:*:*:*:*:*:*",
"matchCriteriaId": "EEAE13AF-DEEE-4284-A93D-EFE2647E12FB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_95:*:*:*:*:*:*",
"matchCriteriaId": "9EEADDC3-C436-452F-9271-8F30A9D03FE6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_96:*:*:*:*:*:*",
"matchCriteriaId": "A775E68D-A18E-433F-A9D0-AB6E71495936",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_97:*:*:*:*:*:*",
"matchCriteriaId": "20CB9AD9-57B1-45E1-B228-EEB4E8615B57",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_98:*:*:*:*:*:*",
"matchCriteriaId": "DEAB4602-D612-4568-9579-5FA3840E415A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_99:*:*:*:*:*:*",
"matchCriteriaId": "C3BDD320-6142-45BA-A57E-965507A1F76F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:-:*:*:*:*:*:*",
"matchCriteriaId": "C2AA7E18-A41B-4F0D-A04F-57C5745D091B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_1:*:*:*:*:*:*",
"matchCriteriaId": "392B783D-620D-4C71-AAA0-848B16964A27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_10:*:*:*:*:*:*",
"matchCriteriaId": "4F5A94E2-22B7-4D2D-A491-29F395E727C5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_11:*:*:*:*:*:*",
"matchCriteriaId": "E9B10908-C42B-4763-9D47-236506B0E84A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_12:*:*:*:*:*:*",
"matchCriteriaId": "CF544435-36AC-49B8-BA50-A6B6D1678BBC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_13:*:*:*:*:*:*",
"matchCriteriaId": "9D265542-5333-4CCD-90E5-B5F6A55F9863",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_14:*:*:*:*:*:*",
"matchCriteriaId": "1763CD8B-3ACD-4617-A1CA-B9F77A074977",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_15:*:*:*:*:*:*",
"matchCriteriaId": "F25C66AA-B60D-413C-A848-51E12D6080AC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_16:*:*:*:*:*:*",
"matchCriteriaId": "071A0D53-EC95-4B18-9FA3-55208B1F7B94",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_17:*:*:*:*:*:*",
"matchCriteriaId": "CC26A9D4-14D6-46B1-BB00-A2C4386EBCA4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_18:*:*:*:*:*:*",
"matchCriteriaId": "350CDEDA-9A20-4BC3-BEAE-8346CED10CD6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_19:*:*:*:*:*:*",
"matchCriteriaId": "10C6107E-79B3-4672-B3E5-8A2FA9A829CF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_2:*:*:*:*:*:*",
"matchCriteriaId": "3233D306-3F8E-40A4-B132-7264E63DD131",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_20:*:*:*:*:*:*",
"matchCriteriaId": "A978B14E-96F6-449F-8D8D-8E782A5A3D19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_21:*:*:*:*:*:*",
"matchCriteriaId": "87600A59-7DD1-49F5-A5A5-EA392193C6A3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_22:*:*:*:*:*:*",
"matchCriteriaId": "33EB9718-E83C-43F4-AFF9-86A83F6F75A4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_23:*:*:*:*:*:*",
"matchCriteriaId": "F7CDDDE5-5E00-41AB-8517-2E5A1427633D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_24:*:*:*:*:*:*",
"matchCriteriaId": "D5B4F901-D5A9-440D-86B4-76B42C833660",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_25:*:*:*:*:*:*",
"matchCriteriaId": "1AB262B6-E817-461A-9F05-15B1B37D9019",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_3:*:*:*:*:*:*",
"matchCriteriaId": "9EAEA45A-0370-475E-B4CB-395A434DC3A1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_4:*:*:*:*:*:*",
"matchCriteriaId": "39310F05-1DB6-43BA-811C-9CB91D6DCF20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_5:*:*:*:*:*:*",
"matchCriteriaId": "D6135B16-C89E-4F49-BA15-823E2AF26D68",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_6:*:*:*:*:*:*",
"matchCriteriaId": "CC887BEC-915B-44AC-B473-5448B3D8DCF7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_7:*:*:*:*:*:*",
"matchCriteriaId": "D7A7CC60-C294-41EC-B000-D15AAA93A3D5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_8:*:*:*:*:*:*",
"matchCriteriaId": "022132F8-6E56-4A29-95D6-3B7861D39CDF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_9:*:*:*:*:*:*",
"matchCriteriaId": "651DA9B7-9C11-47A7-AF5C-95625C8FFF6A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:-:*:*:*:*:*:*",
"matchCriteriaId": "8CAAE1B7-982E-4D50-9651-DEEE6CD74EED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_1:*:*:*:*:*:*",
"matchCriteriaId": "AFCF99EC-3384-418D-A419-B9DB607BE371",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_10:*:*:*:*:*:*",
"matchCriteriaId": "F7CAAF53-AA8E-48CB-9398-35461BE590C4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_11:*:*:*:*:*:*",
"matchCriteriaId": "6FB8482E-644B-4DA5-808B-8DBEAB6D8D09",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_12:*:*:*:*:*:*",
"matchCriteriaId": "95EFE8B5-EE95-4186-AC89-E9AFD8649D01",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_13:*:*:*:*:*:*",
"matchCriteriaId": "90A6E0AF-0B8A-462D-95EF-2239EEE4A50D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_14:*:*:*:*:*:*",
"matchCriteriaId": "48BBAE90-F668-49BF-89AF-2C9547B76836",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_2:*:*:*:*:*:*",
"matchCriteriaId": "31E05134-A0C5-4937-A228-7D0884276B67",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_3:*:*:*:*:*:*",
"matchCriteriaId": "3F06C4AD-FD20-4345-8386-0895312F0A00",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_4:*:*:*:*:*:*",
"matchCriteriaId": "98CC25E2-EC3D-43A2-8D03-06F0E804EA63",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_5:*:*:*:*:*:*",
"matchCriteriaId": "30933C36-C710-488F-9601-EE1BB749C58A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_6:*:*:*:*:*:*",
"matchCriteriaId": "41E94372-A1AE-48B1-82DC-08B7B616473F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_7:*:*:*:*:*:*",
"matchCriteriaId": "51FBC8E0-34F8-475C-A1A8-571791CA05F9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_8:*:*:*:*:*:*",
"matchCriteriaId": "1E73EAEA-FA88-46B9-B9D5-A41603957AD7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_9:*:*:*:*:*:*",
"matchCriteriaId": "CF9BC654-4E3F-4B40-A6E5-79A818A51BED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.3:-:*:*:*:*:*:*",
"matchCriteriaId": "21C55D41-DB66-494D-BEEB-BDAC7CB4B31B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.3:sp1:*:*:*:*:*:*",
"matchCriteriaId": "9D75A0FF-BAEA-471A-87B2-8EC2A9F0A6B5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.3:sp2:*:*:*:*:*:*",
"matchCriteriaId": "D86CDCC0-9655-477B-83FA-ADDBB5AF43A2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.3:sp3:*:*:*:*:*:*",
"matchCriteriaId": "1CF5B84B-1719-4581-8474-C55CEFFD8305",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:*",
"matchCriteriaId": "48765E9D-CDEE-4648-A15F-404BDB51CABD",
"versionEndExcluding": "7.4.2",
"versionStartIncluding": "7.0.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Stored cross-site scripting (XSS) vulnerability in the Site module\u0027s user membership administration page in Liferay Portal 7.0.1 through 7.4.1, and Liferay DXP 7.0 before fix pack 102, 7.1 before fix pack 26, 7.2 before fix pack 15, and 7.3 before service pack 3 allows remote attackers to inject arbitrary web script or HTML via the a user\u0027s name."
},
{
"lang": "es",
"value": "Una vulnerabilidad de tipo cross-site scripting (XSS) Almacenado en la p\u00e1gina de administraci\u00f3n de la membres\u00eda del usuario del m\u00f3dulo Site en Liferay Portal versiones 7.0.1 hasta 7.4.1, y Liferay DXP versi\u00f3n 7.0 versiones anteriores a fix pack 102, 7.1 anteriores a fix pack 26, 7.2 anteriores a fix pack 15, y 7.3 anteriores a service pack 3, permite a atacantes remotos inyectar scripts web o HTML arbitrarios por medio del nombre de un usuario"
}
],
"id": "CVE-2022-28978",
"lastModified": "2024-11-21T06:58:16.700",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.3,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2022-09-22T00:15:09.603",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Product"
],
"url": "http://liferay.com"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-28978-stored-xss-with-user-name-in-site-membership"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Product"
],
"url": "http://liferay.com"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-28978-stored-xss-with-user-name-in-site-membership"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2022-09-22 01:15
Modified
2024-11-21 06:58
Severity ?
Summary
HtmlUtil.escapeRedirect in Liferay Portal 7.3.1 through 7.4.2, and Liferay DXP 7.0 fix pack 91 through 101, 7.1 fix pack 17 through 25, 7.2 fix pack 5 through 14, and 7.3 before service pack 3 can be circumvented by using multiple forward slashes, which allows remote attackers to redirect users to arbitrary external URLs via the (1) 'redirect` parameter (2) `FORWARD_URL` parameter, and (3) others parameters that rely on HtmlUtil.escapeRedirect.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| liferay | dxp | 7.0 | |
| liferay | dxp | 7.0 | |
| liferay | dxp | 7.0 | |
| liferay | dxp | 7.0 | |
| liferay | dxp | 7.0 | |
| liferay | dxp | 7.0 | |
| liferay | dxp | 7.0 | |
| liferay | dxp | 7.0 | |
| liferay | dxp | 7.0 | |
| liferay | dxp | 7.0 | |
| liferay | dxp | 7.0 | |
| liferay | dxp | 7.0 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.3 | |
| liferay | dxp | 7.3 | |
| liferay | dxp | 7.3 | |
| liferay | liferay_portal | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:-:*:*:*:*:*:*",
"matchCriteriaId": "43A92274-7D88-4F0F-8265-CF862011F27F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_100:*:*:*:*:*:*",
"matchCriteriaId": "410D1A51-448F-4E98-BC20-8AB63E4008A7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_101:*:*:*:*:*:*",
"matchCriteriaId": "614C805B-94C4-4486-B791-59DAB1906EB9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_91:*:*:*:*:*:*",
"matchCriteriaId": "FC81C494-F68E-4580-87FB-7792C1080DFC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_92:*:*:*:*:*:*",
"matchCriteriaId": "6693594D-6731-4223-8C28-4873746B97AB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_93:*:*:*:*:*:*",
"matchCriteriaId": "0B96CDC5-F4DE-49A2-B09D-318163EC9A09",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_94:*:*:*:*:*:*",
"matchCriteriaId": "EEAE13AF-DEEE-4284-A93D-EFE2647E12FB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_95:*:*:*:*:*:*",
"matchCriteriaId": "9EEADDC3-C436-452F-9271-8F30A9D03FE6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_96:*:*:*:*:*:*",
"matchCriteriaId": "A775E68D-A18E-433F-A9D0-AB6E71495936",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_97:*:*:*:*:*:*",
"matchCriteriaId": "20CB9AD9-57B1-45E1-B228-EEB4E8615B57",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_98:*:*:*:*:*:*",
"matchCriteriaId": "DEAB4602-D612-4568-9579-5FA3840E415A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_99:*:*:*:*:*:*",
"matchCriteriaId": "C3BDD320-6142-45BA-A57E-965507A1F76F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:-:*:*:*:*:*:*",
"matchCriteriaId": "C2AA7E18-A41B-4F0D-A04F-57C5745D091B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_17:*:*:*:*:*:*",
"matchCriteriaId": "CC26A9D4-14D6-46B1-BB00-A2C4386EBCA4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_18:*:*:*:*:*:*",
"matchCriteriaId": "350CDEDA-9A20-4BC3-BEAE-8346CED10CD6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_19:*:*:*:*:*:*",
"matchCriteriaId": "10C6107E-79B3-4672-B3E5-8A2FA9A829CF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_20:*:*:*:*:*:*",
"matchCriteriaId": "A978B14E-96F6-449F-8D8D-8E782A5A3D19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_21:*:*:*:*:*:*",
"matchCriteriaId": "87600A59-7DD1-49F5-A5A5-EA392193C6A3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_22:*:*:*:*:*:*",
"matchCriteriaId": "33EB9718-E83C-43F4-AFF9-86A83F6F75A4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_23:*:*:*:*:*:*",
"matchCriteriaId": "F7CDDDE5-5E00-41AB-8517-2E5A1427633D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_24:*:*:*:*:*:*",
"matchCriteriaId": "D5B4F901-D5A9-440D-86B4-76B42C833660",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_25:*:*:*:*:*:*",
"matchCriteriaId": "1AB262B6-E817-461A-9F05-15B1B37D9019",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:-:*:*:*:*:*:*",
"matchCriteriaId": "8CAAE1B7-982E-4D50-9651-DEEE6CD74EED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_10:*:*:*:*:*:*",
"matchCriteriaId": "F7CAAF53-AA8E-48CB-9398-35461BE590C4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_11:*:*:*:*:*:*",
"matchCriteriaId": "6FB8482E-644B-4DA5-808B-8DBEAB6D8D09",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_12:*:*:*:*:*:*",
"matchCriteriaId": "95EFE8B5-EE95-4186-AC89-E9AFD8649D01",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_13:*:*:*:*:*:*",
"matchCriteriaId": "90A6E0AF-0B8A-462D-95EF-2239EEE4A50D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_14:*:*:*:*:*:*",
"matchCriteriaId": "48BBAE90-F668-49BF-89AF-2C9547B76836",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_5:*:*:*:*:*:*",
"matchCriteriaId": "30933C36-C710-488F-9601-EE1BB749C58A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_6:*:*:*:*:*:*",
"matchCriteriaId": "41E94372-A1AE-48B1-82DC-08B7B616473F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_7:*:*:*:*:*:*",
"matchCriteriaId": "51FBC8E0-34F8-475C-A1A8-571791CA05F9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_8:*:*:*:*:*:*",
"matchCriteriaId": "1E73EAEA-FA88-46B9-B9D5-A41603957AD7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_9:*:*:*:*:*:*",
"matchCriteriaId": "CF9BC654-4E3F-4B40-A6E5-79A818A51BED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.3:-:*:*:*:*:*:*",
"matchCriteriaId": "21C55D41-DB66-494D-BEEB-BDAC7CB4B31B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.3:sp1:*:*:*:*:*:*",
"matchCriteriaId": "9D75A0FF-BAEA-471A-87B2-8EC2A9F0A6B5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.3:sp2:*:*:*:*:*:*",
"matchCriteriaId": "D86CDCC0-9655-477B-83FA-ADDBB5AF43A2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:*",
"matchCriteriaId": "22E35E99-E5B4-4A85-84CE-3139AFF96B85",
"versionEndExcluding": "7.4.3.4",
"versionStartIncluding": "7.3.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "HtmlUtil.escapeRedirect in Liferay Portal 7.3.1 through 7.4.2, and Liferay DXP 7.0 fix pack 91 through 101, 7.1 fix pack 17 through 25, 7.2 fix pack 5 through 14, and 7.3 before service pack 3 can be circumvented by using multiple forward slashes, which allows remote attackers to redirect users to arbitrary external URLs via the (1) \u0027redirect` parameter (2) `FORWARD_URL` parameter, and (3) others parameters that rely on HtmlUtil.escapeRedirect."
},
{
"lang": "es",
"value": "El archivo HtmlUtil.escapeRedirect en Liferay Portal versiones 7.3.1 hasta 7.4.2, y Liferay DXP versiones 7.0 fix pack 91 hasta 101, 7.1 fix pack 17 hasta 25, 7.2 fix pack 5 hasta 14, y 7. 3 anteriores a service pack 3, puede ser omitido mediante el uso de m\u00faltiples barras diagonales, lo que permite a atacantes remotos redirigir a usuarios a URLs externas arbitrarias por medio del par\u00e1metro (1) \"redirect\" (2) \"FORWARD_URL\" y (3) otros par\u00e1metros que dependen de HtmlUtil.escapeRedirect"
}
],
"id": "CVE-2022-28977",
"lastModified": "2024-11-21T06:58:16.517",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2022-09-22T01:15:10.753",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Product"
],
"url": "http://liferay.com"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-28977-htmlutil.escaperedirect-circumvention-with-multiple-forward-slash"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Product"
],
"url": "http://liferay.com"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-28977-htmlutil.escaperedirect-circumvention-with-multiple-forward-slash"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-601"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2024-02-08 04:15
Modified
2024-11-21 09:00
Severity ?
5.4 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
8.1 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
8.1 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Summary
In Liferay Portal 7.2.0 through 7.4.1, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 15, and older unsupported versions the `doAsUserId` URL parameter may get leaked when creating linked content using the WYSIWYG editor and while impersonating a user. This may allow remote authenticated users to impersonate a user after accessing the linked content.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.3 | |
| liferay | dxp | 7.3 | |
| liferay | dxp | 7.3 | |
| liferay | liferay_portal | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:-:*:*:*:*:*:*",
"matchCriteriaId": "8CAAE1B7-982E-4D50-9651-DEEE6CD74EED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_1:*:*:*:*:*:*",
"matchCriteriaId": "AFCF99EC-3384-418D-A419-B9DB607BE371",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_10:*:*:*:*:*:*",
"matchCriteriaId": "F7CAAF53-AA8E-48CB-9398-35461BE590C4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_11:*:*:*:*:*:*",
"matchCriteriaId": "6FB8482E-644B-4DA5-808B-8DBEAB6D8D09",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_12:*:*:*:*:*:*",
"matchCriteriaId": "95EFE8B5-EE95-4186-AC89-E9AFD8649D01",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_13:*:*:*:*:*:*",
"matchCriteriaId": "90A6E0AF-0B8A-462D-95EF-2239EEE4A50D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_14:*:*:*:*:*:*",
"matchCriteriaId": "48BBAE90-F668-49BF-89AF-2C9547B76836",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_2:*:*:*:*:*:*",
"matchCriteriaId": "31E05134-A0C5-4937-A228-7D0884276B67",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_3:*:*:*:*:*:*",
"matchCriteriaId": "3F06C4AD-FD20-4345-8386-0895312F0A00",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_4:*:*:*:*:*:*",
"matchCriteriaId": "98CC25E2-EC3D-43A2-8D03-06F0E804EA63",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_5:*:*:*:*:*:*",
"matchCriteriaId": "30933C36-C710-488F-9601-EE1BB749C58A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_6:*:*:*:*:*:*",
"matchCriteriaId": "41E94372-A1AE-48B1-82DC-08B7B616473F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_7:*:*:*:*:*:*",
"matchCriteriaId": "51FBC8E0-34F8-475C-A1A8-571791CA05F9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_8:*:*:*:*:*:*",
"matchCriteriaId": "1E73EAEA-FA88-46B9-B9D5-A41603957AD7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_9:*:*:*:*:*:*",
"matchCriteriaId": "CF9BC654-4E3F-4B40-A6E5-79A818A51BED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.3:-:*:*:*:*:*:*",
"matchCriteriaId": "21C55D41-DB66-494D-BEEB-BDAC7CB4B31B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.3:sp1:*:*:*:*:*:*",
"matchCriteriaId": "9D75A0FF-BAEA-471A-87B2-8EC2A9F0A6B5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.3:sp2:*:*:*:*:*:*",
"matchCriteriaId": "D86CDCC0-9655-477B-83FA-ADDBB5AF43A2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:*",
"matchCriteriaId": "F247D45A-D3E4-4EDD-A18D-147FFBEF0935",
"versionEndIncluding": "7.4.1",
"versionStartIncluding": "7.2.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In Liferay Portal 7.2.0 through 7.4.1, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 15, and older unsupported versions the `doAsUserId` URL parameter may get leaked when creating linked content using the WYSIWYG editor and while impersonating a user. This may allow remote authenticated users to impersonate a user after accessing the linked content."
},
{
"lang": "es",
"value": "En Liferay Portal 7.2.0 a 7.4.1 y versiones anteriores no compatibles, y Liferay DXP 7.3 anterior al service pack 3, 7.2 anterior al fix pack 15 y versiones anteriores no compatibles, el par\u00e1metro URL `doAsUserId` puede filtrarse al crear contenido vinculado mediante el editor WYSIWYG y mientras se hace pasar por un usuario. Esto puede permitir que los usuarios autenticados remotamente se hagan pasar por un usuario despu\u00e9s de acceder al contenido vinculado."
}
],
"id": "CVE-2024-25148",
"lastModified": "2024-11-21T09:00:21.143",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 2.5,
"source": "security@liferay.com",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 5.2,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2024-02-08T04:15:08.240",
"references": [
{
"source": "security@liferay.com",
"tags": [
"Vendor Advisory"
],
"url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25148"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25148"
}
],
"sourceIdentifier": "security@liferay.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-201"
}
],
"source": "security@liferay.com",
"type": "Secondary"
},
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-noinfo"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2021-08-03 21:15
Modified
2024-11-21 06:08
Severity ?
Summary
Open redirect vulnerability in the Notifications module in Liferay Portal 7.0.0 through 7.3.1, and Liferay DXP 7.0 before fix pack 94, 7.1 before fix pack 19 and 7.2 before fix pack 8, allows remote attackers to redirect users to arbitrary external URLs via the 'redirect' parameter.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | https://issues.liferay.com/browse/LPE-17022 | Patch, Vendor Advisory | |
| cve@mitre.org | https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120747627 | Release Notes, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://issues.liferay.com/browse/LPE-17022 | Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120747627 | Release Notes, Vendor Advisory |
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:-:*:*:*:*:*:*",
"matchCriteriaId": "43A92274-7D88-4F0F-8265-CF862011F27F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_13:*:*:*:*:*:*",
"matchCriteriaId": "4874012D-52AA-4C32-95E9-BD331225B4E6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_14:*:*:*:*:*:*",
"matchCriteriaId": "21CAF86F-CEC9-44EE-BAF8-0F7AF9D945F5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_24:*:*:*:*:*:*",
"matchCriteriaId": "EF6C9F29-EEFF-4737-BD50-58572D6C14E9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_25:*:*:*:*:*:*",
"matchCriteriaId": "D24E1FA0-BD94-4AFC-92BF-AEDEBC7DCF4B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_26:*:*:*:*:*:*",
"matchCriteriaId": "FF9B54EE-973B-44B4-8EA2-B58FA49AC561",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_27:*:*:*:*:*:*",
"matchCriteriaId": "A9637223-557D-474B-A46B-D276866376C3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_28:*:*:*:*:*:*",
"matchCriteriaId": "F6306F9C-99DE-4F94-8E7F-6747762BEC45",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_3\\+:*:*:*:*:*:*",
"matchCriteriaId": "2DFF08F0-77C1-43A0-B7DD-9B905BE074EB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_30:*:*:*:*:*:*",
"matchCriteriaId": "48B7015C-26B9-453E-B3CF-9B220D3A8024",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_33:*:*:*:*:*:*",
"matchCriteriaId": "0FEB6921-3C45-4B7E-8B34-CDC34984583D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_35:*:*:*:*:*:*",
"matchCriteriaId": "525F45DC-2E5C-46A8-AEDF-9D6B8FA2EB11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_36:*:*:*:*:*:*",
"matchCriteriaId": "55755D0C-4C0C-42D9-BE5E-5D33C8BA4C7F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_39:*:*:*:*:*:*",
"matchCriteriaId": "FB4FE0F9-EB19-45D7-A953-674629D951F5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_40:*:*:*:*:*:*",
"matchCriteriaId": "22E4B63F-01A9-4F85-92BC-A51F41BE4121",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_41:*:*:*:*:*:*",
"matchCriteriaId": "23BE441D-8770-4F4D-86CD-4E53161F54FB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_42:*:*:*:*:*:*",
"matchCriteriaId": "E14FF010-3907-4C79-B945-C792E446CB31",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_43:*:*:*:*:*:*",
"matchCriteriaId": "B97B5817-B55E-485D-9747-3A50CF7245C8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_44:*:*:*:*:*:*",
"matchCriteriaId": "19EBD671-56BD-45D3-9248-DAF3F47B36FD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_45:*:*:*:*:*:*",
"matchCriteriaId": "93EDC2A1-9622-44DB-ABA8-754D61B60787",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_46:*:*:*:*:*:*",
"matchCriteriaId": "B4B6A06D-C323-431C-9A65-4FD6A6E4CAB6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_47:*:*:*:*:*:*",
"matchCriteriaId": "EE6D4466-1C3A-4D5A-A65C-A30A87EADF1A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_48:*:*:*:*:*:*",
"matchCriteriaId": "4F0BC40A-8E13-4665-A2E4-F5815CA70E17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_49:*:*:*:*:*:*",
"matchCriteriaId": "11FB69C3-7755-495A-AB76-201AF4D9623B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_50:*:*:*:*:*:*",
"matchCriteriaId": "FF66F652-6C08-4D47-865D-36E70360B632",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_51:*:*:*:*:*:*",
"matchCriteriaId": "17B68D59-0509-4C6A-B803-03A02EB76F1F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_52:*:*:*:*:*:*",
"matchCriteriaId": "8F69B287-3B86-4B64-BCB4-40E9495A628D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_53:*:*:*:*:*:*",
"matchCriteriaId": "C627090E-A1BF-4332-9538-EE4E184DB65E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_54:*:*:*:*:*:*",
"matchCriteriaId": "9A089471-9944-4C75-A25F-1F23C18C0CF0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_56:*:*:*:*:*:*",
"matchCriteriaId": "B90E7FBF-6B5B-457A-8B20-ECA69A626BB8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_57:*:*:*:*:*:*",
"matchCriteriaId": "1975C1AB-EF50-42E2-9879-17FB763B45F9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_58:*:*:*:*:*:*",
"matchCriteriaId": "DFB7BB13-773B-47A6-A001-B9EBA46C917E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_59:*:*:*:*:*:*",
"matchCriteriaId": "1C4A2D39-3725-4E80-9F3F-AC1F4EE662E8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_60:*:*:*:*:*:*",
"matchCriteriaId": "BAEDF88B-B9C8-4891-B199-A72C066FC7BF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_61:*:*:*:*:*:*",
"matchCriteriaId": "F768E1DD-3DC6-4783-82DE-D089C7CD3C63",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_64:*:*:*:*:*:*",
"matchCriteriaId": "426EDA92-FE5A-4523-8AAE-1E5D5D67F535",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_65:*:*:*:*:*:*",
"matchCriteriaId": "070CB609-6D4B-4817-9F91-00BD62423E56",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_66:*:*:*:*:*:*",
"matchCriteriaId": "FEE87846-A4CF-47E5-93AA-5D7E2548D28D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_67:*:*:*:*:*:*",
"matchCriteriaId": "A4C11B0E-6D94-4A65-83BE-1E5828710CB9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_68:*:*:*:*:*:*",
"matchCriteriaId": "F1DC73B1-4017-424F-A28D-F54F2FA8ED8C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_69:*:*:*:*:*:*",
"matchCriteriaId": "32B4FD3C-7BB7-4DA2-9A3A-05A6370B9745",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_70:*:*:*:*:*:*",
"matchCriteriaId": "71293E5B-4DCC-47BC-A493-3540D57E6067",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_71:*:*:*:*:*:*",
"matchCriteriaId": "56A8940B-318E-4C6A-9131-A50E90E82C28",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_72:*:*:*:*:*:*",
"matchCriteriaId": "F09B5E82-DC18-4B07-9A05-E433579B4FB5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_73:*:*:*:*:*:*",
"matchCriteriaId": "CE25D189-2D6F-4229-BF09-2CEA0A6C5D50",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_75:*:*:*:*:*:*",
"matchCriteriaId": "36549BE5-DEDB-408A-BFC9-AB00031D45DD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_76:*:*:*:*:*:*",
"matchCriteriaId": "E11B8075-4212-41CB-85AC-09FA1CDB86A1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_78:*:*:*:*:*:*",
"matchCriteriaId": "80412DCE-D79F-492A-8788-6A43C4D76D7C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_79:*:*:*:*:*:*",
"matchCriteriaId": "BC7A939F-21D1-4AF1-BAB9-E91DFCFFB7A2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_80:*:*:*:*:*:*",
"matchCriteriaId": "5F2240FC-EDDC-47F5-B713-07FF2D23CE00",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_81:*:*:*:*:*:*",
"matchCriteriaId": "5006AAE4-B154-468A-850C-20171965E2AC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_82:*:*:*:*:*:*",
"matchCriteriaId": "1541072D-3F14-47A2-8A42-EF2765643AE4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_83:*:*:*:*:*:*",
"matchCriteriaId": "2340C85F-0296-4591-8D23-56634C50C5F8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_84:*:*:*:*:*:*",
"matchCriteriaId": "6BEC3C5C-DA8C-4620-A38E-BB47D4CB7CBA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_85:*:*:*:*:*:*",
"matchCriteriaId": "6DD38B1F-7EEA-4DB5-A31B-D84DC33313FA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_86:*:*:*:*:*:*",
"matchCriteriaId": "FC923A9E-CF9D-44DE-AB58-7BCAAFDDE7D6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_87:*:*:*:*:*:*",
"matchCriteriaId": "65542031-04E1-485F-8102-04CB65865ECE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_88:*:*:*:*:*:*",
"matchCriteriaId": "B36F2FBD-E949-4608-9ECF-0F05DD8E487E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_89:*:*:*:*:*:*",
"matchCriteriaId": "D68832F1-6D71-4A63-AA8A-86C0EDF9F8E1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_90:*:*:*:*:*:*",
"matchCriteriaId": "FD1F579A-084C-46A9-ADCA-8F3FA45D85D6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_91:*:*:*:*:*:*",
"matchCriteriaId": "FC81C494-F68E-4580-87FB-7792C1080DFC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_92:*:*:*:*:*:*",
"matchCriteriaId": "6693594D-6731-4223-8C28-4873746B97AB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_93:*:*:*:*:*:*",
"matchCriteriaId": "0B96CDC5-F4DE-49A2-B09D-318163EC9A09",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:-:*:*:*:*:*:*",
"matchCriteriaId": "C2AA7E18-A41B-4F0D-A04F-57C5745D091B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_1:*:*:*:*:*:*",
"matchCriteriaId": "392B783D-620D-4C71-AAA0-848B16964A27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_10:*:*:*:*:*:*",
"matchCriteriaId": "4F5A94E2-22B7-4D2D-A491-29F395E727C5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_11:*:*:*:*:*:*",
"matchCriteriaId": "E9B10908-C42B-4763-9D47-236506B0E84A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_12:*:*:*:*:*:*",
"matchCriteriaId": "CF544435-36AC-49B8-BA50-A6B6D1678BBC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_13:*:*:*:*:*:*",
"matchCriteriaId": "9D265542-5333-4CCD-90E5-B5F6A55F9863",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_14:*:*:*:*:*:*",
"matchCriteriaId": "1763CD8B-3ACD-4617-A1CA-B9F77A074977",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_15:*:*:*:*:*:*",
"matchCriteriaId": "F25C66AA-B60D-413C-A848-51E12D6080AC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_16:*:*:*:*:*:*",
"matchCriteriaId": "071A0D53-EC95-4B18-9FA3-55208B1F7B94",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_17:*:*:*:*:*:*",
"matchCriteriaId": "CC26A9D4-14D6-46B1-BB00-A2C4386EBCA4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_18:*:*:*:*:*:*",
"matchCriteriaId": "350CDEDA-9A20-4BC3-BEAE-8346CED10CD6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_2:*:*:*:*:*:*",
"matchCriteriaId": "3233D306-3F8E-40A4-B132-7264E63DD131",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_3:*:*:*:*:*:*",
"matchCriteriaId": "9EAEA45A-0370-475E-B4CB-395A434DC3A1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_4:*:*:*:*:*:*",
"matchCriteriaId": "39310F05-1DB6-43BA-811C-9CB91D6DCF20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_5:*:*:*:*:*:*",
"matchCriteriaId": "D6135B16-C89E-4F49-BA15-823E2AF26D68",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_6:*:*:*:*:*:*",
"matchCriteriaId": "CC887BEC-915B-44AC-B473-5448B3D8DCF7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_7:*:*:*:*:*:*",
"matchCriteriaId": "D7A7CC60-C294-41EC-B000-D15AAA93A3D5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_8:*:*:*:*:*:*",
"matchCriteriaId": "022132F8-6E56-4A29-95D6-3B7861D39CDF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_9:*:*:*:*:*:*",
"matchCriteriaId": "651DA9B7-9C11-47A7-AF5C-95625C8FFF6A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:-:*:*:*:*:*:*",
"matchCriteriaId": "8CAAE1B7-982E-4D50-9651-DEEE6CD74EED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_1:*:*:*:*:*:*",
"matchCriteriaId": "AFCF99EC-3384-418D-A419-B9DB607BE371",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_2:*:*:*:*:*:*",
"matchCriteriaId": "31E05134-A0C5-4937-A228-7D0884276B67",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_3:*:*:*:*:*:*",
"matchCriteriaId": "3F06C4AD-FD20-4345-8386-0895312F0A00",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_4:*:*:*:*:*:*",
"matchCriteriaId": "98CC25E2-EC3D-43A2-8D03-06F0E804EA63",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_5:*:*:*:*:*:*",
"matchCriteriaId": "30933C36-C710-488F-9601-EE1BB749C58A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_6:*:*:*:*:*:*",
"matchCriteriaId": "41E94372-A1AE-48B1-82DC-08B7B616473F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_7:*:*:*:*:*:*",
"matchCriteriaId": "51FBC8E0-34F8-475C-A1A8-571791CA05F9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:*",
"matchCriteriaId": "AC608B59-98F9-4FDD-A37D-87E5096E1756",
"versionEndExcluding": "7.3.2",
"versionStartIncluding": "7.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Open redirect vulnerability in the Notifications module in Liferay Portal 7.0.0 through 7.3.1, and Liferay DXP 7.0 before fix pack 94, 7.1 before fix pack 19 and 7.2 before fix pack 8, allows remote attackers to redirect users to arbitrary external URLs via the \u0027redirect\u0027 parameter."
},
{
"lang": "es",
"value": "Una vulnerabilidad de redireccionamiento abierto en el m\u00f3dulo Notifications de Liferay Portal versiones 7.0.0 hasta 7.3.1, y Liferay DXP versiones 7.0 anteriores a fix pack 94, versiones 7.1 anteriores a fix pack 19 y versiones 7.2 anteriores a fix pack 8, permite a atacantes remotos redirigir a usuarios a URLs externas arbitrario por medio del par\u00e1metro \"redirect\""
}
],
"id": "CVE-2021-33331",
"lastModified": "2024-11-21T06:08:42.440",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 4.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2021-08-03T21:15:08.490",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://issues.liferay.com/browse/LPE-17022"
},
{
"source": "cve@mitre.org",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120747627"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://issues.liferay.com/browse/LPE-17022"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120747627"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-601"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2021-05-17 11:15
Modified
2024-11-21 06:00
Severity ?
Summary
The Portal Store module in Liferay Portal 7.0.0 through 7.3.5, and Liferay DXP 7.0 before fix pack 97, 7.1 before fix pack 21, 7.2 before fix pack 10 and 7.3 before fix pack 1 does not obfuscate the S3 store's proxy password, which allows attackers to steal the proxy password via man-in-the-middle attacks or shoulder surfing.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:-:*:*:*:*:*:*",
"matchCriteriaId": "43A92274-7D88-4F0F-8265-CF862011F27F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_13:*:*:*:*:*:*",
"matchCriteriaId": "4874012D-52AA-4C32-95E9-BD331225B4E6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_14:*:*:*:*:*:*",
"matchCriteriaId": "21CAF86F-CEC9-44EE-BAF8-0F7AF9D945F5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_24:*:*:*:*:*:*",
"matchCriteriaId": "EF6C9F29-EEFF-4737-BD50-58572D6C14E9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_25:*:*:*:*:*:*",
"matchCriteriaId": "D24E1FA0-BD94-4AFC-92BF-AEDEBC7DCF4B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_26:*:*:*:*:*:*",
"matchCriteriaId": "FF9B54EE-973B-44B4-8EA2-B58FA49AC561",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_27:*:*:*:*:*:*",
"matchCriteriaId": "A9637223-557D-474B-A46B-D276866376C3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_28:*:*:*:*:*:*",
"matchCriteriaId": "F6306F9C-99DE-4F94-8E7F-6747762BEC45",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_3\\+:*:*:*:*:*:*",
"matchCriteriaId": "2DFF08F0-77C1-43A0-B7DD-9B905BE074EB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_30:*:*:*:*:*:*",
"matchCriteriaId": "48B7015C-26B9-453E-B3CF-9B220D3A8024",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_33:*:*:*:*:*:*",
"matchCriteriaId": "0FEB6921-3C45-4B7E-8B34-CDC34984583D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_35:*:*:*:*:*:*",
"matchCriteriaId": "525F45DC-2E5C-46A8-AEDF-9D6B8FA2EB11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_36:*:*:*:*:*:*",
"matchCriteriaId": "55755D0C-4C0C-42D9-BE5E-5D33C8BA4C7F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_39:*:*:*:*:*:*",
"matchCriteriaId": "FB4FE0F9-EB19-45D7-A953-674629D951F5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_40:*:*:*:*:*:*",
"matchCriteriaId": "22E4B63F-01A9-4F85-92BC-A51F41BE4121",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_41:*:*:*:*:*:*",
"matchCriteriaId": "23BE441D-8770-4F4D-86CD-4E53161F54FB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_42:*:*:*:*:*:*",
"matchCriteriaId": "E14FF010-3907-4C79-B945-C792E446CB31",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_43:*:*:*:*:*:*",
"matchCriteriaId": "B97B5817-B55E-485D-9747-3A50CF7245C8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_44:*:*:*:*:*:*",
"matchCriteriaId": "19EBD671-56BD-45D3-9248-DAF3F47B36FD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_45:*:*:*:*:*:*",
"matchCriteriaId": "93EDC2A1-9622-44DB-ABA8-754D61B60787",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_46:*:*:*:*:*:*",
"matchCriteriaId": "B4B6A06D-C323-431C-9A65-4FD6A6E4CAB6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_47:*:*:*:*:*:*",
"matchCriteriaId": "EE6D4466-1C3A-4D5A-A65C-A30A87EADF1A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_48:*:*:*:*:*:*",
"matchCriteriaId": "4F0BC40A-8E13-4665-A2E4-F5815CA70E17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_49:*:*:*:*:*:*",
"matchCriteriaId": "11FB69C3-7755-495A-AB76-201AF4D9623B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_50:*:*:*:*:*:*",
"matchCriteriaId": "FF66F652-6C08-4D47-865D-36E70360B632",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_51:*:*:*:*:*:*",
"matchCriteriaId": "17B68D59-0509-4C6A-B803-03A02EB76F1F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_52:*:*:*:*:*:*",
"matchCriteriaId": "8F69B287-3B86-4B64-BCB4-40E9495A628D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_53:*:*:*:*:*:*",
"matchCriteriaId": "C627090E-A1BF-4332-9538-EE4E184DB65E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_54:*:*:*:*:*:*",
"matchCriteriaId": "9A089471-9944-4C75-A25F-1F23C18C0CF0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_56:*:*:*:*:*:*",
"matchCriteriaId": "B90E7FBF-6B5B-457A-8B20-ECA69A626BB8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_57:*:*:*:*:*:*",
"matchCriteriaId": "1975C1AB-EF50-42E2-9879-17FB763B45F9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_58:*:*:*:*:*:*",
"matchCriteriaId": "DFB7BB13-773B-47A6-A001-B9EBA46C917E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_59:*:*:*:*:*:*",
"matchCriteriaId": "1C4A2D39-3725-4E80-9F3F-AC1F4EE662E8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_60:*:*:*:*:*:*",
"matchCriteriaId": "BAEDF88B-B9C8-4891-B199-A72C066FC7BF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_61:*:*:*:*:*:*",
"matchCriteriaId": "F768E1DD-3DC6-4783-82DE-D089C7CD3C63",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_64:*:*:*:*:*:*",
"matchCriteriaId": "426EDA92-FE5A-4523-8AAE-1E5D5D67F535",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_65:*:*:*:*:*:*",
"matchCriteriaId": "070CB609-6D4B-4817-9F91-00BD62423E56",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_66:*:*:*:*:*:*",
"matchCriteriaId": "FEE87846-A4CF-47E5-93AA-5D7E2548D28D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_67:*:*:*:*:*:*",
"matchCriteriaId": "A4C11B0E-6D94-4A65-83BE-1E5828710CB9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_68:*:*:*:*:*:*",
"matchCriteriaId": "F1DC73B1-4017-424F-A28D-F54F2FA8ED8C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_69:*:*:*:*:*:*",
"matchCriteriaId": "32B4FD3C-7BB7-4DA2-9A3A-05A6370B9745",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_70:*:*:*:*:*:*",
"matchCriteriaId": "71293E5B-4DCC-47BC-A493-3540D57E6067",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_71:*:*:*:*:*:*",
"matchCriteriaId": "56A8940B-318E-4C6A-9131-A50E90E82C28",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_72:*:*:*:*:*:*",
"matchCriteriaId": "F09B5E82-DC18-4B07-9A05-E433579B4FB5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_73:*:*:*:*:*:*",
"matchCriteriaId": "CE25D189-2D6F-4229-BF09-2CEA0A6C5D50",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_75:*:*:*:*:*:*",
"matchCriteriaId": "36549BE5-DEDB-408A-BFC9-AB00031D45DD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_76:*:*:*:*:*:*",
"matchCriteriaId": "E11B8075-4212-41CB-85AC-09FA1CDB86A1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_78:*:*:*:*:*:*",
"matchCriteriaId": "80412DCE-D79F-492A-8788-6A43C4D76D7C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_79:*:*:*:*:*:*",
"matchCriteriaId": "BC7A939F-21D1-4AF1-BAB9-E91DFCFFB7A2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_80:*:*:*:*:*:*",
"matchCriteriaId": "5F2240FC-EDDC-47F5-B713-07FF2D23CE00",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_81:*:*:*:*:*:*",
"matchCriteriaId": "5006AAE4-B154-468A-850C-20171965E2AC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_82:*:*:*:*:*:*",
"matchCriteriaId": "1541072D-3F14-47A2-8A42-EF2765643AE4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_83:*:*:*:*:*:*",
"matchCriteriaId": "2340C85F-0296-4591-8D23-56634C50C5F8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_84:*:*:*:*:*:*",
"matchCriteriaId": "6BEC3C5C-DA8C-4620-A38E-BB47D4CB7CBA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_85:*:*:*:*:*:*",
"matchCriteriaId": "6DD38B1F-7EEA-4DB5-A31B-D84DC33313FA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_86:*:*:*:*:*:*",
"matchCriteriaId": "FC923A9E-CF9D-44DE-AB58-7BCAAFDDE7D6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_87:*:*:*:*:*:*",
"matchCriteriaId": "65542031-04E1-485F-8102-04CB65865ECE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_88:*:*:*:*:*:*",
"matchCriteriaId": "B36F2FBD-E949-4608-9ECF-0F05DD8E487E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_89:*:*:*:*:*:*",
"matchCriteriaId": "D68832F1-6D71-4A63-AA8A-86C0EDF9F8E1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_90:*:*:*:*:*:*",
"matchCriteriaId": "FD1F579A-084C-46A9-ADCA-8F3FA45D85D6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_91:*:*:*:*:*:*",
"matchCriteriaId": "FC81C494-F68E-4580-87FB-7792C1080DFC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_92:*:*:*:*:*:*",
"matchCriteriaId": "6693594D-6731-4223-8C28-4873746B97AB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_93:*:*:*:*:*:*",
"matchCriteriaId": "0B96CDC5-F4DE-49A2-B09D-318163EC9A09",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_94:*:*:*:*:*:*",
"matchCriteriaId": "EEAE13AF-DEEE-4284-A93D-EFE2647E12FB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_95:*:*:*:*:*:*",
"matchCriteriaId": "9EEADDC3-C436-452F-9271-8F30A9D03FE6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_96:*:*:*:*:*:*",
"matchCriteriaId": "A775E68D-A18E-433F-A9D0-AB6E71495936",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_1:*:*:*:*:*:*",
"matchCriteriaId": "392B783D-620D-4C71-AAA0-848B16964A27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_10:*:*:*:*:*:*",
"matchCriteriaId": "4F5A94E2-22B7-4D2D-A491-29F395E727C5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_11:*:*:*:*:*:*",
"matchCriteriaId": "E9B10908-C42B-4763-9D47-236506B0E84A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_12:*:*:*:*:*:*",
"matchCriteriaId": "CF544435-36AC-49B8-BA50-A6B6D1678BBC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_13:*:*:*:*:*:*",
"matchCriteriaId": "9D265542-5333-4CCD-90E5-B5F6A55F9863",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_14:*:*:*:*:*:*",
"matchCriteriaId": "1763CD8B-3ACD-4617-A1CA-B9F77A074977",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_15:*:*:*:*:*:*",
"matchCriteriaId": "F25C66AA-B60D-413C-A848-51E12D6080AC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_16:*:*:*:*:*:*",
"matchCriteriaId": "071A0D53-EC95-4B18-9FA3-55208B1F7B94",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_17:*:*:*:*:*:*",
"matchCriteriaId": "CC26A9D4-14D6-46B1-BB00-A2C4386EBCA4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_18:*:*:*:*:*:*",
"matchCriteriaId": "350CDEDA-9A20-4BC3-BEAE-8346CED10CD6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_19:*:*:*:*:*:*",
"matchCriteriaId": "10C6107E-79B3-4672-B3E5-8A2FA9A829CF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_2:*:*:*:*:*:*",
"matchCriteriaId": "3233D306-3F8E-40A4-B132-7264E63DD131",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_20:*:*:*:*:*:*",
"matchCriteriaId": "A978B14E-96F6-449F-8D8D-8E782A5A3D19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_3:*:*:*:*:*:*",
"matchCriteriaId": "9EAEA45A-0370-475E-B4CB-395A434DC3A1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_4:*:*:*:*:*:*",
"matchCriteriaId": "39310F05-1DB6-43BA-811C-9CB91D6DCF20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_5:*:*:*:*:*:*",
"matchCriteriaId": "D6135B16-C89E-4F49-BA15-823E2AF26D68",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_6:*:*:*:*:*:*",
"matchCriteriaId": "CC887BEC-915B-44AC-B473-5448B3D8DCF7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_7:*:*:*:*:*:*",
"matchCriteriaId": "D7A7CC60-C294-41EC-B000-D15AAA93A3D5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_8:*:*:*:*:*:*",
"matchCriteriaId": "022132F8-6E56-4A29-95D6-3B7861D39CDF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_9:*:*:*:*:*:*",
"matchCriteriaId": "651DA9B7-9C11-47A7-AF5C-95625C8FFF6A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:-:*:*:*:*:*:*",
"matchCriteriaId": "8CAAE1B7-982E-4D50-9651-DEEE6CD74EED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_1:*:*:*:*:*:*",
"matchCriteriaId": "AFCF99EC-3384-418D-A419-B9DB607BE371",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_2:*:*:*:*:*:*",
"matchCriteriaId": "31E05134-A0C5-4937-A228-7D0884276B67",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_3:*:*:*:*:*:*",
"matchCriteriaId": "3F06C4AD-FD20-4345-8386-0895312F0A00",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_4:*:*:*:*:*:*",
"matchCriteriaId": "98CC25E2-EC3D-43A2-8D03-06F0E804EA63",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_5:*:*:*:*:*:*",
"matchCriteriaId": "30933C36-C710-488F-9601-EE1BB749C58A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_6:*:*:*:*:*:*",
"matchCriteriaId": "41E94372-A1AE-48B1-82DC-08B7B616473F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_7:*:*:*:*:*:*",
"matchCriteriaId": "51FBC8E0-34F8-475C-A1A8-571791CA05F9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_8:*:*:*:*:*:*",
"matchCriteriaId": "1E73EAEA-FA88-46B9-B9D5-A41603957AD7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_9:*:*:*:*:*:*",
"matchCriteriaId": "CF9BC654-4E3F-4B40-A6E5-79A818A51BED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.3:-:*:*:*:*:*:*",
"matchCriteriaId": "21C55D41-DB66-494D-BEEB-BDAC7CB4B31B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:*",
"matchCriteriaId": "E447EF84-77FA-448B-8E40-DB216B9B715E",
"versionEndIncluding": "7.3.5",
"versionStartIncluding": "7.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The Portal Store module in Liferay Portal 7.0.0 through 7.3.5, and Liferay DXP 7.0 before fix pack 97, 7.1 before fix pack 21, 7.2 before fix pack 10 and 7.3 before fix pack 1 does not obfuscate the S3 store\u0027s proxy password, which allows attackers to steal the proxy password via man-in-the-middle attacks or shoulder surfing."
},
{
"lang": "es",
"value": "El m\u00f3dulo Portal Store en Liferay Portal versiones 7.0.0 hasta 7.3.5 y Liferay DXP versiones 7.0 anteriores al fixpack 97, versiones 7.1 anteriores al fixpack 21, versiones 7.2 anteriores al fixpack 10 y versiones 7.3 anteriores a fixpack 1, no oculta la contrase\u00f1a de proxy de la tienda S3, el cual permite a atacantes robar la contrase\u00f1a del proxy por medio de ataques de tipo man-in-the-middle o navegaci\u00f3n lateral"
}
],
"id": "CVE-2021-29043",
"lastModified": "2024-11-21T06:00:34.883",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.2,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2021-05-17T11:15:07.127",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://liferay.com"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120743515"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://liferay.com"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120743515"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-522"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2022-09-22 00:15
Modified
2024-11-21 06:58
Severity ?
Summary
Liferay Portal v7.1.0 through v7.4.2 and Liferay DXP 7.1 before fix pack 26, 7.2 before fix pack 15, and 7.3 before service pack 3 was discovered to contain a cross-site scripting (XSS) vulnerability in the Portal Search module's Custom Facet widget. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Custom Parameter Name text field.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.1 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.3 | |
| liferay | dxp | 7.3 | |
| liferay | dxp | 7.3 | |
| liferay | dxp | 7.3 | |
| liferay | liferay_portal | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:-:*:*:*:*:*:*",
"matchCriteriaId": "C2AA7E18-A41B-4F0D-A04F-57C5745D091B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_1:*:*:*:*:*:*",
"matchCriteriaId": "392B783D-620D-4C71-AAA0-848B16964A27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_10:*:*:*:*:*:*",
"matchCriteriaId": "4F5A94E2-22B7-4D2D-A491-29F395E727C5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_11:*:*:*:*:*:*",
"matchCriteriaId": "E9B10908-C42B-4763-9D47-236506B0E84A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_12:*:*:*:*:*:*",
"matchCriteriaId": "CF544435-36AC-49B8-BA50-A6B6D1678BBC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_13:*:*:*:*:*:*",
"matchCriteriaId": "9D265542-5333-4CCD-90E5-B5F6A55F9863",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_14:*:*:*:*:*:*",
"matchCriteriaId": "1763CD8B-3ACD-4617-A1CA-B9F77A074977",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_15:*:*:*:*:*:*",
"matchCriteriaId": "F25C66AA-B60D-413C-A848-51E12D6080AC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_16:*:*:*:*:*:*",
"matchCriteriaId": "071A0D53-EC95-4B18-9FA3-55208B1F7B94",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_17:*:*:*:*:*:*",
"matchCriteriaId": "CC26A9D4-14D6-46B1-BB00-A2C4386EBCA4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_18:*:*:*:*:*:*",
"matchCriteriaId": "350CDEDA-9A20-4BC3-BEAE-8346CED10CD6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_19:*:*:*:*:*:*",
"matchCriteriaId": "10C6107E-79B3-4672-B3E5-8A2FA9A829CF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_2:*:*:*:*:*:*",
"matchCriteriaId": "3233D306-3F8E-40A4-B132-7264E63DD131",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_20:*:*:*:*:*:*",
"matchCriteriaId": "A978B14E-96F6-449F-8D8D-8E782A5A3D19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_21:*:*:*:*:*:*",
"matchCriteriaId": "87600A59-7DD1-49F5-A5A5-EA392193C6A3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_22:*:*:*:*:*:*",
"matchCriteriaId": "33EB9718-E83C-43F4-AFF9-86A83F6F75A4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_23:*:*:*:*:*:*",
"matchCriteriaId": "F7CDDDE5-5E00-41AB-8517-2E5A1427633D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_24:*:*:*:*:*:*",
"matchCriteriaId": "D5B4F901-D5A9-440D-86B4-76B42C833660",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_25:*:*:*:*:*:*",
"matchCriteriaId": "1AB262B6-E817-461A-9F05-15B1B37D9019",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_3:*:*:*:*:*:*",
"matchCriteriaId": "9EAEA45A-0370-475E-B4CB-395A434DC3A1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_4:*:*:*:*:*:*",
"matchCriteriaId": "39310F05-1DB6-43BA-811C-9CB91D6DCF20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_5:*:*:*:*:*:*",
"matchCriteriaId": "D6135B16-C89E-4F49-BA15-823E2AF26D68",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_6:*:*:*:*:*:*",
"matchCriteriaId": "CC887BEC-915B-44AC-B473-5448B3D8DCF7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_7:*:*:*:*:*:*",
"matchCriteriaId": "D7A7CC60-C294-41EC-B000-D15AAA93A3D5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_8:*:*:*:*:*:*",
"matchCriteriaId": "022132F8-6E56-4A29-95D6-3B7861D39CDF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_9:*:*:*:*:*:*",
"matchCriteriaId": "651DA9B7-9C11-47A7-AF5C-95625C8FFF6A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:-:*:*:*:*:*:*",
"matchCriteriaId": "8CAAE1B7-982E-4D50-9651-DEEE6CD74EED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_1:*:*:*:*:*:*",
"matchCriteriaId": "AFCF99EC-3384-418D-A419-B9DB607BE371",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_10:*:*:*:*:*:*",
"matchCriteriaId": "F7CAAF53-AA8E-48CB-9398-35461BE590C4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_11:*:*:*:*:*:*",
"matchCriteriaId": "6FB8482E-644B-4DA5-808B-8DBEAB6D8D09",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_12:*:*:*:*:*:*",
"matchCriteriaId": "95EFE8B5-EE95-4186-AC89-E9AFD8649D01",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_13:*:*:*:*:*:*",
"matchCriteriaId": "90A6E0AF-0B8A-462D-95EF-2239EEE4A50D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_14:*:*:*:*:*:*",
"matchCriteriaId": "48BBAE90-F668-49BF-89AF-2C9547B76836",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_2:*:*:*:*:*:*",
"matchCriteriaId": "31E05134-A0C5-4937-A228-7D0884276B67",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_3:*:*:*:*:*:*",
"matchCriteriaId": "3F06C4AD-FD20-4345-8386-0895312F0A00",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_4:*:*:*:*:*:*",
"matchCriteriaId": "98CC25E2-EC3D-43A2-8D03-06F0E804EA63",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_5:*:*:*:*:*:*",
"matchCriteriaId": "30933C36-C710-488F-9601-EE1BB749C58A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_6:*:*:*:*:*:*",
"matchCriteriaId": "41E94372-A1AE-48B1-82DC-08B7B616473F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_7:*:*:*:*:*:*",
"matchCriteriaId": "51FBC8E0-34F8-475C-A1A8-571791CA05F9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_8:*:*:*:*:*:*",
"matchCriteriaId": "1E73EAEA-FA88-46B9-B9D5-A41603957AD7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_9:*:*:*:*:*:*",
"matchCriteriaId": "CF9BC654-4E3F-4B40-A6E5-79A818A51BED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.3:-:*:*:*:*:*:*",
"matchCriteriaId": "21C55D41-DB66-494D-BEEB-BDAC7CB4B31B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.3:sp1:*:*:*:*:*:*",
"matchCriteriaId": "9D75A0FF-BAEA-471A-87B2-8EC2A9F0A6B5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.3:sp2:*:*:*:*:*:*",
"matchCriteriaId": "D86CDCC0-9655-477B-83FA-ADDBB5AF43A2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.3:sp3:*:*:*:*:*:*",
"matchCriteriaId": "1CF5B84B-1719-4581-8474-C55CEFFD8305",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:*",
"matchCriteriaId": "71B2CB88-0B25-4CFC-A223-B740E2847FD3",
"versionEndExcluding": "7.4.3.4",
"versionStartIncluding": "7.1.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Liferay Portal v7.1.0 through v7.4.2 and Liferay DXP 7.1 before fix pack 26, 7.2 before fix pack 15, and 7.3 before service pack 3 was discovered to contain a cross-site scripting (XSS) vulnerability in the Portal Search module\u0027s Custom Facet widget. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Custom Parameter Name text field."
},
{
"lang": "es",
"value": "Se ha detectado que Liferay Portal versioens v7.1.0 hasta v7.4.2 y Liferay DXP versiones 7.1 antes del fix pack 26, 7.2 antes del fix pack 15 y 7.3 antes del service pack 3 contienen una vulnerabilidad de cross-site scripting (XSS) en el widget Custom Facet del m\u00f3dulo Portal Search. Esta vulnerabilidad permite a los atacantes ejecutar scripts web o HTML arbitrarios a trav\u00e9s de una carga \u00fatil manipulada inyectada en el campo de texto Custom Parameter Name"
}
],
"id": "CVE-2022-28979",
"lastModified": "2024-11-21T06:58:16.883",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2022-09-22T00:15:09.880",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Product"
],
"url": "http://liferay.com"
},
{
"source": "cve@mitre.org",
"tags": [
"Issue Tracking",
"Patch",
"Vendor Advisory"
],
"url": "https://issues.liferay.com/browse/LPE-17381"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-28979-xss-in-custom-facet-widget"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Product"
],
"url": "http://liferay.com"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Issue Tracking",
"Patch",
"Vendor Advisory"
],
"url": "https://issues.liferay.com/browse/LPE-17381"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-28979-xss-in-custom-facet-widget"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2024-02-07 15:15
Modified
2024-11-21 09:00
Severity ?
9.6 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
5.4 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
5.4 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Summary
Stored cross-site scripting (XSS) vulnerability in the Portal Search module's Search Result app in Liferay Portal 7.2.0 through 7.4.3.11, and older unsupported versions, and Liferay DXP 7.4 before update 8, 7.3 before update 4, 7.2 before fix pack 17, and older unsupported versions allows remote authenticated users to inject arbitrary web script or HTML into the Search Result app's search result if highlighting is disabled by adding any searchable content (e.g., blog, message board message, web content article) to the application.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| liferay | dxp | * | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.2 | |
| liferay | dxp | 7.3 | |
| liferay | dxp | 7.3 | |
| liferay | dxp | 7.3 | |
| liferay | dxp | 7.3 | |
| liferay | dxp | 7.3 | |
| liferay | dxp | 7.3 | |
| liferay | dxp | 7.3 | |
| liferay | dxp | 7.3 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | liferay_portal | * | |
| liferay | liferay_portal | * | |
| liferay | liferay_portal | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:liferay:dxp:*:*:*:*:*:*:*:*",
"matchCriteriaId": "5BC18F4F-2284-4E3E-B8AC-8EDE1649C635",
"versionEndExcluding": "7.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:-:*:*:*:*:*:*",
"matchCriteriaId": "8CAAE1B7-982E-4D50-9651-DEEE6CD74EED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_1:*:*:*:*:*:*",
"matchCriteriaId": "AFCF99EC-3384-418D-A419-B9DB607BE371",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_10:*:*:*:*:*:*",
"matchCriteriaId": "F7CAAF53-AA8E-48CB-9398-35461BE590C4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_11:*:*:*:*:*:*",
"matchCriteriaId": "6FB8482E-644B-4DA5-808B-8DBEAB6D8D09",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_12:*:*:*:*:*:*",
"matchCriteriaId": "95EFE8B5-EE95-4186-AC89-E9AFD8649D01",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_13:*:*:*:*:*:*",
"matchCriteriaId": "90A6E0AF-0B8A-462D-95EF-2239EEE4A50D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_14:*:*:*:*:*:*",
"matchCriteriaId": "48BBAE90-F668-49BF-89AF-2C9547B76836",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_15:*:*:*:*:*:*",
"matchCriteriaId": "74FAF597-EAAD-4BB5-AB99-8129476A7E89",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_2:*:*:*:*:*:*",
"matchCriteriaId": "31E05134-A0C5-4937-A228-7D0884276B67",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_3:*:*:*:*:*:*",
"matchCriteriaId": "3F06C4AD-FD20-4345-8386-0895312F0A00",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_4:*:*:*:*:*:*",
"matchCriteriaId": "98CC25E2-EC3D-43A2-8D03-06F0E804EA63",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_5:*:*:*:*:*:*",
"matchCriteriaId": "30933C36-C710-488F-9601-EE1BB749C58A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_6:*:*:*:*:*:*",
"matchCriteriaId": "41E94372-A1AE-48B1-82DC-08B7B616473F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_7:*:*:*:*:*:*",
"matchCriteriaId": "51FBC8E0-34F8-475C-A1A8-571791CA05F9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_8:*:*:*:*:*:*",
"matchCriteriaId": "1E73EAEA-FA88-46B9-B9D5-A41603957AD7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_9:*:*:*:*:*:*",
"matchCriteriaId": "CF9BC654-4E3F-4B40-A6E5-79A818A51BED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.3:-:*:*:*:*:*:*",
"matchCriteriaId": "21C55D41-DB66-494D-BEEB-BDAC7CB4B31B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.3:fix_pack_2:*:*:*:*:*:*",
"matchCriteriaId": "50EA838E-E234-4EE1-8193-5FAD0E093940",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.3:sp1:*:*:*:*:*:*",
"matchCriteriaId": "9D75A0FF-BAEA-471A-87B2-8EC2A9F0A6B5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.3:sp2:*:*:*:*:*:*",
"matchCriteriaId": "D86CDCC0-9655-477B-83FA-ADDBB5AF43A2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.3:sp3:*:*:*:*:*:*",
"matchCriteriaId": "1CF5B84B-1719-4581-8474-C55CEFFD8305",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.3:update_1:*:*:*:*:*:*",
"matchCriteriaId": "D60CDAA3-6029-4904-9D08-BB221BCFD7C3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.3:update_2:*:*:*:*:*:*",
"matchCriteriaId": "B66F47E9-3D82-497E-BD84-E47A65FAF8C3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.3:update_3:*:*:*:*:*:*",
"matchCriteriaId": "A0BA4856-59DF-427C-959F-3B836314F5D5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:-:*:*:*:*:*:*",
"matchCriteriaId": "ADB5F13C-EE1E-4448-8FCF-5966F6874440",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_1:*:*:*:*:*:*",
"matchCriteriaId": "46AF397F-A95C-4FAD-A6EA-CB623B7A262A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_2:*:*:*:*:*:*",
"matchCriteriaId": "C2C2351E-BDEE-4A79-A00C-6520B54996EF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_3:*:*:*:*:*:*",
"matchCriteriaId": "25F5C3E9-CBB0-4114-91A4-41F0E666026A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_4:*:*:*:*:*:*",
"matchCriteriaId": "5E2B5687-B311-460E-A562-D754AF271F8E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_5:*:*:*:*:*:*",
"matchCriteriaId": "B49D0CB9-8ED7-46AB-9BA5-7235A2CD9117",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_6:*:*:*:*:*:*",
"matchCriteriaId": "DF169364-096C-4294-B89F-C07AF1DCC9C4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_7:*:*:*:*:*:*",
"matchCriteriaId": "30CB2C54-1A20-4226-ACC6-AC8131899AE2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:*",
"matchCriteriaId": "345F6776-E492-489C-AC23-760BBC693A4F",
"versionEndIncluding": "7.2.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:*",
"matchCriteriaId": "13F59EAA-9EC8-44CC-8F56-BC26981F584F",
"versionEndIncluding": "7.3.7",
"versionStartIncluding": "7.3.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:*",
"matchCriteriaId": "9DCE033F-5706-4060-8ED1-BB386019325D",
"versionEndExcluding": "7.4.3.12",
"versionStartIncluding": "7.4.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Stored cross-site scripting (XSS) vulnerability in the Portal Search module\u0027s Search Result app in Liferay Portal 7.2.0 through 7.4.3.11, and older unsupported versions, and Liferay DXP 7.4 before update 8, 7.3 before update 4, 7.2 before fix pack 17, and older unsupported versions allows remote authenticated users to inject arbitrary web script or HTML into the Search Result app\u0027s search result if highlighting is disabled by adding any searchable content (e.g., blog, message board message, web content article) to the application."
},
{
"lang": "es",
"value": "Vulnerabilidad de cross-site scripting (XSS) almacenado en la aplicaci\u00f3n Resultados de b\u00fasqueda del m\u00f3dulo Portal Search en Liferay Portal 7.2.0 a 7.4.3.11 y versiones anteriores no compatibles, y Liferay DXP 7.4 antes de la actualizaci\u00f3n 8, 7.3 antes de la actualizaci\u00f3n 4, 7.2 antes del fixpack 17 y versiones anteriores no compatibles permiten a los usuarios autenticados remotamente inyectar scripts web o HTML arbitrario en el resultado de b\u00fasqueda de la aplicaci\u00f3n Resultados de b\u00fasqueda si el resaltado est\u00e1 deshabilitado agregando cualquier contenido que permita realizar b\u00fasquedas (por ejemplo, blog, mensaje en el tablero de mensajes, art\u00edculo de contenido web) a la aplicaci\u00f3n."
}
],
"id": "CVE-2024-25145",
"lastModified": "2024-11-21T09:00:20.713",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.6,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 6.0,
"source": "security@liferay.com",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.3,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2024-02-07T15:15:09.097",
"references": [
{
"source": "security@liferay.com",
"tags": [
"Vendor Advisory"
],
"url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25145"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25145"
}
],
"sourceIdentifier": "security@liferay.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "security@liferay.com",
"type": "Secondary"
},
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2021-08-03 19:15
Modified
2024-11-21 06:08
Severity ?
Summary
In Liferay Portal 7.3.0 and earlier, and Liferay DXP 7.0 before fix pack 96, 7.1 before fix pack 18, and 7.2 before fix pack 5, password reset tokens are not invalidated after a user changes their password, which allows remote attackers to change the user’s password via the old password reset token.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | https://issues.liferay.com/browse/LPE-16981 | Patch, Vendor Advisory | |
| cve@mitre.org | https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120748020 | Release Notes, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://issues.liferay.com/browse/LPE-16981 | Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120748020 | Release Notes, Vendor Advisory |
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:-:*:*:*:*:*:*",
"matchCriteriaId": "43A92274-7D88-4F0F-8265-CF862011F27F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_13:*:*:*:*:*:*",
"matchCriteriaId": "4874012D-52AA-4C32-95E9-BD331225B4E6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_14:*:*:*:*:*:*",
"matchCriteriaId": "21CAF86F-CEC9-44EE-BAF8-0F7AF9D945F5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_24:*:*:*:*:*:*",
"matchCriteriaId": "EF6C9F29-EEFF-4737-BD50-58572D6C14E9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_25:*:*:*:*:*:*",
"matchCriteriaId": "D24E1FA0-BD94-4AFC-92BF-AEDEBC7DCF4B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_26:*:*:*:*:*:*",
"matchCriteriaId": "FF9B54EE-973B-44B4-8EA2-B58FA49AC561",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_27:*:*:*:*:*:*",
"matchCriteriaId": "A9637223-557D-474B-A46B-D276866376C3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_28:*:*:*:*:*:*",
"matchCriteriaId": "F6306F9C-99DE-4F94-8E7F-6747762BEC45",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_3\\+:*:*:*:*:*:*",
"matchCriteriaId": "2DFF08F0-77C1-43A0-B7DD-9B905BE074EB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_30:*:*:*:*:*:*",
"matchCriteriaId": "48B7015C-26B9-453E-B3CF-9B220D3A8024",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_33:*:*:*:*:*:*",
"matchCriteriaId": "0FEB6921-3C45-4B7E-8B34-CDC34984583D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_35:*:*:*:*:*:*",
"matchCriteriaId": "525F45DC-2E5C-46A8-AEDF-9D6B8FA2EB11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_36:*:*:*:*:*:*",
"matchCriteriaId": "55755D0C-4C0C-42D9-BE5E-5D33C8BA4C7F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_39:*:*:*:*:*:*",
"matchCriteriaId": "FB4FE0F9-EB19-45D7-A953-674629D951F5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_40:*:*:*:*:*:*",
"matchCriteriaId": "22E4B63F-01A9-4F85-92BC-A51F41BE4121",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_41:*:*:*:*:*:*",
"matchCriteriaId": "23BE441D-8770-4F4D-86CD-4E53161F54FB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_42:*:*:*:*:*:*",
"matchCriteriaId": "E14FF010-3907-4C79-B945-C792E446CB31",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_43:*:*:*:*:*:*",
"matchCriteriaId": "B97B5817-B55E-485D-9747-3A50CF7245C8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_44:*:*:*:*:*:*",
"matchCriteriaId": "19EBD671-56BD-45D3-9248-DAF3F47B36FD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_45:*:*:*:*:*:*",
"matchCriteriaId": "93EDC2A1-9622-44DB-ABA8-754D61B60787",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_46:*:*:*:*:*:*",
"matchCriteriaId": "B4B6A06D-C323-431C-9A65-4FD6A6E4CAB6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_47:*:*:*:*:*:*",
"matchCriteriaId": "EE6D4466-1C3A-4D5A-A65C-A30A87EADF1A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_48:*:*:*:*:*:*",
"matchCriteriaId": "4F0BC40A-8E13-4665-A2E4-F5815CA70E17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_49:*:*:*:*:*:*",
"matchCriteriaId": "11FB69C3-7755-495A-AB76-201AF4D9623B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_50:*:*:*:*:*:*",
"matchCriteriaId": "FF66F652-6C08-4D47-865D-36E70360B632",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_51:*:*:*:*:*:*",
"matchCriteriaId": "17B68D59-0509-4C6A-B803-03A02EB76F1F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_52:*:*:*:*:*:*",
"matchCriteriaId": "8F69B287-3B86-4B64-BCB4-40E9495A628D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_53:*:*:*:*:*:*",
"matchCriteriaId": "C627090E-A1BF-4332-9538-EE4E184DB65E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_54:*:*:*:*:*:*",
"matchCriteriaId": "9A089471-9944-4C75-A25F-1F23C18C0CF0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_56:*:*:*:*:*:*",
"matchCriteriaId": "B90E7FBF-6B5B-457A-8B20-ECA69A626BB8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_57:*:*:*:*:*:*",
"matchCriteriaId": "1975C1AB-EF50-42E2-9879-17FB763B45F9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_58:*:*:*:*:*:*",
"matchCriteriaId": "DFB7BB13-773B-47A6-A001-B9EBA46C917E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_59:*:*:*:*:*:*",
"matchCriteriaId": "1C4A2D39-3725-4E80-9F3F-AC1F4EE662E8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_60:*:*:*:*:*:*",
"matchCriteriaId": "BAEDF88B-B9C8-4891-B199-A72C066FC7BF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_61:*:*:*:*:*:*",
"matchCriteriaId": "F768E1DD-3DC6-4783-82DE-D089C7CD3C63",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_64:*:*:*:*:*:*",
"matchCriteriaId": "426EDA92-FE5A-4523-8AAE-1E5D5D67F535",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_65:*:*:*:*:*:*",
"matchCriteriaId": "070CB609-6D4B-4817-9F91-00BD62423E56",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_66:*:*:*:*:*:*",
"matchCriteriaId": "FEE87846-A4CF-47E5-93AA-5D7E2548D28D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_67:*:*:*:*:*:*",
"matchCriteriaId": "A4C11B0E-6D94-4A65-83BE-1E5828710CB9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_68:*:*:*:*:*:*",
"matchCriteriaId": "F1DC73B1-4017-424F-A28D-F54F2FA8ED8C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_69:*:*:*:*:*:*",
"matchCriteriaId": "32B4FD3C-7BB7-4DA2-9A3A-05A6370B9745",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_70:*:*:*:*:*:*",
"matchCriteriaId": "71293E5B-4DCC-47BC-A493-3540D57E6067",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_71:*:*:*:*:*:*",
"matchCriteriaId": "56A8940B-318E-4C6A-9131-A50E90E82C28",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_72:*:*:*:*:*:*",
"matchCriteriaId": "F09B5E82-DC18-4B07-9A05-E433579B4FB5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_73:*:*:*:*:*:*",
"matchCriteriaId": "CE25D189-2D6F-4229-BF09-2CEA0A6C5D50",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_75:*:*:*:*:*:*",
"matchCriteriaId": "36549BE5-DEDB-408A-BFC9-AB00031D45DD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_76:*:*:*:*:*:*",
"matchCriteriaId": "E11B8075-4212-41CB-85AC-09FA1CDB86A1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_78:*:*:*:*:*:*",
"matchCriteriaId": "80412DCE-D79F-492A-8788-6A43C4D76D7C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_79:*:*:*:*:*:*",
"matchCriteriaId": "BC7A939F-21D1-4AF1-BAB9-E91DFCFFB7A2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_80:*:*:*:*:*:*",
"matchCriteriaId": "5F2240FC-EDDC-47F5-B713-07FF2D23CE00",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_81:*:*:*:*:*:*",
"matchCriteriaId": "5006AAE4-B154-468A-850C-20171965E2AC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_82:*:*:*:*:*:*",
"matchCriteriaId": "1541072D-3F14-47A2-8A42-EF2765643AE4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_83:*:*:*:*:*:*",
"matchCriteriaId": "2340C85F-0296-4591-8D23-56634C50C5F8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_84:*:*:*:*:*:*",
"matchCriteriaId": "6BEC3C5C-DA8C-4620-A38E-BB47D4CB7CBA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_85:*:*:*:*:*:*",
"matchCriteriaId": "6DD38B1F-7EEA-4DB5-A31B-D84DC33313FA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_86:*:*:*:*:*:*",
"matchCriteriaId": "FC923A9E-CF9D-44DE-AB58-7BCAAFDDE7D6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_87:*:*:*:*:*:*",
"matchCriteriaId": "65542031-04E1-485F-8102-04CB65865ECE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_88:*:*:*:*:*:*",
"matchCriteriaId": "B36F2FBD-E949-4608-9ECF-0F05DD8E487E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_89:*:*:*:*:*:*",
"matchCriteriaId": "D68832F1-6D71-4A63-AA8A-86C0EDF9F8E1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_90:*:*:*:*:*:*",
"matchCriteriaId": "FD1F579A-084C-46A9-ADCA-8F3FA45D85D6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_91:*:*:*:*:*:*",
"matchCriteriaId": "FC81C494-F68E-4580-87FB-7792C1080DFC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_92:*:*:*:*:*:*",
"matchCriteriaId": "6693594D-6731-4223-8C28-4873746B97AB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_93:*:*:*:*:*:*",
"matchCriteriaId": "0B96CDC5-F4DE-49A2-B09D-318163EC9A09",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_94:*:*:*:*:*:*",
"matchCriteriaId": "EEAE13AF-DEEE-4284-A93D-EFE2647E12FB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_95:*:*:*:*:*:*",
"matchCriteriaId": "9EEADDC3-C436-452F-9271-8F30A9D03FE6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:-:*:*:*:*:*:*",
"matchCriteriaId": "C2AA7E18-A41B-4F0D-A04F-57C5745D091B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_1:*:*:*:*:*:*",
"matchCriteriaId": "392B783D-620D-4C71-AAA0-848B16964A27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_10:*:*:*:*:*:*",
"matchCriteriaId": "4F5A94E2-22B7-4D2D-A491-29F395E727C5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_11:*:*:*:*:*:*",
"matchCriteriaId": "E9B10908-C42B-4763-9D47-236506B0E84A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_12:*:*:*:*:*:*",
"matchCriteriaId": "CF544435-36AC-49B8-BA50-A6B6D1678BBC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_13:*:*:*:*:*:*",
"matchCriteriaId": "9D265542-5333-4CCD-90E5-B5F6A55F9863",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_14:*:*:*:*:*:*",
"matchCriteriaId": "1763CD8B-3ACD-4617-A1CA-B9F77A074977",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_15:*:*:*:*:*:*",
"matchCriteriaId": "F25C66AA-B60D-413C-A848-51E12D6080AC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_16:*:*:*:*:*:*",
"matchCriteriaId": "071A0D53-EC95-4B18-9FA3-55208B1F7B94",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_17:*:*:*:*:*:*",
"matchCriteriaId": "CC26A9D4-14D6-46B1-BB00-A2C4386EBCA4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_18:*:*:*:*:*:*",
"matchCriteriaId": "350CDEDA-9A20-4BC3-BEAE-8346CED10CD6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_2:*:*:*:*:*:*",
"matchCriteriaId": "3233D306-3F8E-40A4-B132-7264E63DD131",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_3:*:*:*:*:*:*",
"matchCriteriaId": "9EAEA45A-0370-475E-B4CB-395A434DC3A1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_4:*:*:*:*:*:*",
"matchCriteriaId": "39310F05-1DB6-43BA-811C-9CB91D6DCF20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_5:*:*:*:*:*:*",
"matchCriteriaId": "D6135B16-C89E-4F49-BA15-823E2AF26D68",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_6:*:*:*:*:*:*",
"matchCriteriaId": "CC887BEC-915B-44AC-B473-5448B3D8DCF7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_7:*:*:*:*:*:*",
"matchCriteriaId": "D7A7CC60-C294-41EC-B000-D15AAA93A3D5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_8:*:*:*:*:*:*",
"matchCriteriaId": "022132F8-6E56-4A29-95D6-3B7861D39CDF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_9:*:*:*:*:*:*",
"matchCriteriaId": "651DA9B7-9C11-47A7-AF5C-95625C8FFF6A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:-:*:*:*:*:*:*",
"matchCriteriaId": "8CAAE1B7-982E-4D50-9651-DEEE6CD74EED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_1:*:*:*:*:*:*",
"matchCriteriaId": "AFCF99EC-3384-418D-A419-B9DB607BE371",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_2:*:*:*:*:*:*",
"matchCriteriaId": "31E05134-A0C5-4937-A228-7D0884276B67",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_3:*:*:*:*:*:*",
"matchCriteriaId": "3F06C4AD-FD20-4345-8386-0895312F0A00",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_4:*:*:*:*:*:*",
"matchCriteriaId": "98CC25E2-EC3D-43A2-8D03-06F0E804EA63",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:*",
"matchCriteriaId": "73CDC2CC-EE82-4010-88E5-EDC175DA4D47",
"versionEndExcluding": "7.3.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In Liferay Portal 7.3.0 and earlier, and Liferay DXP 7.0 before fix pack 96, 7.1 before fix pack 18, and 7.2 before fix pack 5, password reset tokens are not invalidated after a user changes their password, which allows remote attackers to change the user\u2019s password via the old password reset token."
},
{
"lang": "es",
"value": "En Liferay Portal versiones 7.3.0 y anteriores, y Liferay DXP versiones 7.0 anteriores a fix pack 96, versiones 7.1 anteriores a fix pack 18, y versiones 7.2 anteriores a fix pack 5, los tokens de restablecimiento de contrase\u00f1a no son invalidados despu\u00e9s de que un usuario cambie su contrase\u00f1a, lo que permite a atacantes remotos cambiar la contrase\u00f1a del usuario por medio del antiguo token de restablecimiento de contrase\u00f1a"
}
],
"id": "CVE-2021-33322",
"lastModified": "2024-11-21T06:08:41.217",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2021-08-03T19:15:08.623",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://issues.liferay.com/browse/LPE-16981"
},
{
"source": "cve@mitre.org",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120748020"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://issues.liferay.com/browse/LPE-16981"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120748020"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-613"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2021-08-03 19:15
Modified
2024-11-21 06:08
Severity ?
Summary
The Portal Workflow module in Liferay Portal 7.3.2 and earlier, and Liferay DXP 7.0 before fix pack 93, 7.1 before fix pack 19, and 7.2 before fix pack 7, user's clear text passwords are stored in the database if workflow is enabled for user creation, which allows attackers with access to the database to obtain a user's password.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | https://issues.liferay.com/browse/LPE-17042 | Patch, Vendor Advisory | |
| cve@mitre.org | https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120748389 | Release Notes, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://issues.liferay.com/browse/LPE-17042 | Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120748389 | Release Notes, Vendor Advisory |
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:-:*:*:*:*:*:*",
"matchCriteriaId": "43A92274-7D88-4F0F-8265-CF862011F27F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_13:*:*:*:*:*:*",
"matchCriteriaId": "4874012D-52AA-4C32-95E9-BD331225B4E6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_14:*:*:*:*:*:*",
"matchCriteriaId": "21CAF86F-CEC9-44EE-BAF8-0F7AF9D945F5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_24:*:*:*:*:*:*",
"matchCriteriaId": "EF6C9F29-EEFF-4737-BD50-58572D6C14E9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_25:*:*:*:*:*:*",
"matchCriteriaId": "D24E1FA0-BD94-4AFC-92BF-AEDEBC7DCF4B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_26:*:*:*:*:*:*",
"matchCriteriaId": "FF9B54EE-973B-44B4-8EA2-B58FA49AC561",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_27:*:*:*:*:*:*",
"matchCriteriaId": "A9637223-557D-474B-A46B-D276866376C3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_28:*:*:*:*:*:*",
"matchCriteriaId": "F6306F9C-99DE-4F94-8E7F-6747762BEC45",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_3\\+:*:*:*:*:*:*",
"matchCriteriaId": "2DFF08F0-77C1-43A0-B7DD-9B905BE074EB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_30:*:*:*:*:*:*",
"matchCriteriaId": "48B7015C-26B9-453E-B3CF-9B220D3A8024",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_33:*:*:*:*:*:*",
"matchCriteriaId": "0FEB6921-3C45-4B7E-8B34-CDC34984583D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_35:*:*:*:*:*:*",
"matchCriteriaId": "525F45DC-2E5C-46A8-AEDF-9D6B8FA2EB11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_36:*:*:*:*:*:*",
"matchCriteriaId": "55755D0C-4C0C-42D9-BE5E-5D33C8BA4C7F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_39:*:*:*:*:*:*",
"matchCriteriaId": "FB4FE0F9-EB19-45D7-A953-674629D951F5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_40:*:*:*:*:*:*",
"matchCriteriaId": "22E4B63F-01A9-4F85-92BC-A51F41BE4121",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_41:*:*:*:*:*:*",
"matchCriteriaId": "23BE441D-8770-4F4D-86CD-4E53161F54FB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_42:*:*:*:*:*:*",
"matchCriteriaId": "E14FF010-3907-4C79-B945-C792E446CB31",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_43:*:*:*:*:*:*",
"matchCriteriaId": "B97B5817-B55E-485D-9747-3A50CF7245C8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_44:*:*:*:*:*:*",
"matchCriteriaId": "19EBD671-56BD-45D3-9248-DAF3F47B36FD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_45:*:*:*:*:*:*",
"matchCriteriaId": "93EDC2A1-9622-44DB-ABA8-754D61B60787",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_46:*:*:*:*:*:*",
"matchCriteriaId": "B4B6A06D-C323-431C-9A65-4FD6A6E4CAB6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_47:*:*:*:*:*:*",
"matchCriteriaId": "EE6D4466-1C3A-4D5A-A65C-A30A87EADF1A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_48:*:*:*:*:*:*",
"matchCriteriaId": "4F0BC40A-8E13-4665-A2E4-F5815CA70E17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_49:*:*:*:*:*:*",
"matchCriteriaId": "11FB69C3-7755-495A-AB76-201AF4D9623B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_50:*:*:*:*:*:*",
"matchCriteriaId": "FF66F652-6C08-4D47-865D-36E70360B632",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_51:*:*:*:*:*:*",
"matchCriteriaId": "17B68D59-0509-4C6A-B803-03A02EB76F1F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_52:*:*:*:*:*:*",
"matchCriteriaId": "8F69B287-3B86-4B64-BCB4-40E9495A628D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_53:*:*:*:*:*:*",
"matchCriteriaId": "C627090E-A1BF-4332-9538-EE4E184DB65E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_54:*:*:*:*:*:*",
"matchCriteriaId": "9A089471-9944-4C75-A25F-1F23C18C0CF0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_56:*:*:*:*:*:*",
"matchCriteriaId": "B90E7FBF-6B5B-457A-8B20-ECA69A626BB8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_57:*:*:*:*:*:*",
"matchCriteriaId": "1975C1AB-EF50-42E2-9879-17FB763B45F9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_58:*:*:*:*:*:*",
"matchCriteriaId": "DFB7BB13-773B-47A6-A001-B9EBA46C917E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_59:*:*:*:*:*:*",
"matchCriteriaId": "1C4A2D39-3725-4E80-9F3F-AC1F4EE662E8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_60:*:*:*:*:*:*",
"matchCriteriaId": "BAEDF88B-B9C8-4891-B199-A72C066FC7BF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_61:*:*:*:*:*:*",
"matchCriteriaId": "F768E1DD-3DC6-4783-82DE-D089C7CD3C63",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_64:*:*:*:*:*:*",
"matchCriteriaId": "426EDA92-FE5A-4523-8AAE-1E5D5D67F535",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_65:*:*:*:*:*:*",
"matchCriteriaId": "070CB609-6D4B-4817-9F91-00BD62423E56",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_66:*:*:*:*:*:*",
"matchCriteriaId": "FEE87846-A4CF-47E5-93AA-5D7E2548D28D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_67:*:*:*:*:*:*",
"matchCriteriaId": "A4C11B0E-6D94-4A65-83BE-1E5828710CB9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_68:*:*:*:*:*:*",
"matchCriteriaId": "F1DC73B1-4017-424F-A28D-F54F2FA8ED8C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_69:*:*:*:*:*:*",
"matchCriteriaId": "32B4FD3C-7BB7-4DA2-9A3A-05A6370B9745",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_70:*:*:*:*:*:*",
"matchCriteriaId": "71293E5B-4DCC-47BC-A493-3540D57E6067",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_71:*:*:*:*:*:*",
"matchCriteriaId": "56A8940B-318E-4C6A-9131-A50E90E82C28",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_72:*:*:*:*:*:*",
"matchCriteriaId": "F09B5E82-DC18-4B07-9A05-E433579B4FB5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_73:*:*:*:*:*:*",
"matchCriteriaId": "CE25D189-2D6F-4229-BF09-2CEA0A6C5D50",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_75:*:*:*:*:*:*",
"matchCriteriaId": "36549BE5-DEDB-408A-BFC9-AB00031D45DD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_76:*:*:*:*:*:*",
"matchCriteriaId": "E11B8075-4212-41CB-85AC-09FA1CDB86A1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_78:*:*:*:*:*:*",
"matchCriteriaId": "80412DCE-D79F-492A-8788-6A43C4D76D7C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_79:*:*:*:*:*:*",
"matchCriteriaId": "BC7A939F-21D1-4AF1-BAB9-E91DFCFFB7A2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_80:*:*:*:*:*:*",
"matchCriteriaId": "5F2240FC-EDDC-47F5-B713-07FF2D23CE00",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_81:*:*:*:*:*:*",
"matchCriteriaId": "5006AAE4-B154-468A-850C-20171965E2AC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_82:*:*:*:*:*:*",
"matchCriteriaId": "1541072D-3F14-47A2-8A42-EF2765643AE4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_83:*:*:*:*:*:*",
"matchCriteriaId": "2340C85F-0296-4591-8D23-56634C50C5F8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_84:*:*:*:*:*:*",
"matchCriteriaId": "6BEC3C5C-DA8C-4620-A38E-BB47D4CB7CBA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_85:*:*:*:*:*:*",
"matchCriteriaId": "6DD38B1F-7EEA-4DB5-A31B-D84DC33313FA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_86:*:*:*:*:*:*",
"matchCriteriaId": "FC923A9E-CF9D-44DE-AB58-7BCAAFDDE7D6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_87:*:*:*:*:*:*",
"matchCriteriaId": "65542031-04E1-485F-8102-04CB65865ECE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_88:*:*:*:*:*:*",
"matchCriteriaId": "B36F2FBD-E949-4608-9ECF-0F05DD8E487E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_89:*:*:*:*:*:*",
"matchCriteriaId": "D68832F1-6D71-4A63-AA8A-86C0EDF9F8E1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_90:*:*:*:*:*:*",
"matchCriteriaId": "FD1F579A-084C-46A9-ADCA-8F3FA45D85D6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_91:*:*:*:*:*:*",
"matchCriteriaId": "FC81C494-F68E-4580-87FB-7792C1080DFC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_92:*:*:*:*:*:*",
"matchCriteriaId": "6693594D-6731-4223-8C28-4873746B97AB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:-:*:*:*:*:*:*",
"matchCriteriaId": "C2AA7E18-A41B-4F0D-A04F-57C5745D091B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_1:*:*:*:*:*:*",
"matchCriteriaId": "392B783D-620D-4C71-AAA0-848B16964A27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_10:*:*:*:*:*:*",
"matchCriteriaId": "4F5A94E2-22B7-4D2D-A491-29F395E727C5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_11:*:*:*:*:*:*",
"matchCriteriaId": "E9B10908-C42B-4763-9D47-236506B0E84A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_12:*:*:*:*:*:*",
"matchCriteriaId": "CF544435-36AC-49B8-BA50-A6B6D1678BBC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_13:*:*:*:*:*:*",
"matchCriteriaId": "9D265542-5333-4CCD-90E5-B5F6A55F9863",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_14:*:*:*:*:*:*",
"matchCriteriaId": "1763CD8B-3ACD-4617-A1CA-B9F77A074977",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_15:*:*:*:*:*:*",
"matchCriteriaId": "F25C66AA-B60D-413C-A848-51E12D6080AC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_16:*:*:*:*:*:*",
"matchCriteriaId": "071A0D53-EC95-4B18-9FA3-55208B1F7B94",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_17:*:*:*:*:*:*",
"matchCriteriaId": "CC26A9D4-14D6-46B1-BB00-A2C4386EBCA4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_18:*:*:*:*:*:*",
"matchCriteriaId": "350CDEDA-9A20-4BC3-BEAE-8346CED10CD6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_2:*:*:*:*:*:*",
"matchCriteriaId": "3233D306-3F8E-40A4-B132-7264E63DD131",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_3:*:*:*:*:*:*",
"matchCriteriaId": "9EAEA45A-0370-475E-B4CB-395A434DC3A1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_4:*:*:*:*:*:*",
"matchCriteriaId": "39310F05-1DB6-43BA-811C-9CB91D6DCF20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_5:*:*:*:*:*:*",
"matchCriteriaId": "D6135B16-C89E-4F49-BA15-823E2AF26D68",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_6:*:*:*:*:*:*",
"matchCriteriaId": "CC887BEC-915B-44AC-B473-5448B3D8DCF7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_7:*:*:*:*:*:*",
"matchCriteriaId": "D7A7CC60-C294-41EC-B000-D15AAA93A3D5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_8:*:*:*:*:*:*",
"matchCriteriaId": "022132F8-6E56-4A29-95D6-3B7861D39CDF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_9:*:*:*:*:*:*",
"matchCriteriaId": "651DA9B7-9C11-47A7-AF5C-95625C8FFF6A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:-:*:*:*:*:*:*",
"matchCriteriaId": "8CAAE1B7-982E-4D50-9651-DEEE6CD74EED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_1:*:*:*:*:*:*",
"matchCriteriaId": "AFCF99EC-3384-418D-A419-B9DB607BE371",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_2:*:*:*:*:*:*",
"matchCriteriaId": "31E05134-A0C5-4937-A228-7D0884276B67",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_3:*:*:*:*:*:*",
"matchCriteriaId": "3F06C4AD-FD20-4345-8386-0895312F0A00",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_4:*:*:*:*:*:*",
"matchCriteriaId": "98CC25E2-EC3D-43A2-8D03-06F0E804EA63",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_5:*:*:*:*:*:*",
"matchCriteriaId": "30933C36-C710-488F-9601-EE1BB749C58A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_6:*:*:*:*:*:*",
"matchCriteriaId": "41E94372-A1AE-48B1-82DC-08B7B616473F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:*",
"matchCriteriaId": "94896449-7A52-40D2-8E76-26DC60D7BA9A",
"versionEndExcluding": "7.3.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The Portal Workflow module in Liferay Portal 7.3.2 and earlier, and Liferay DXP 7.0 before fix pack 93, 7.1 before fix pack 19, and 7.2 before fix pack 7, user\u0027s clear text passwords are stored in the database if workflow is enabled for user creation, which allows attackers with access to the database to obtain a user\u0027s password."
},
{
"lang": "es",
"value": "El m\u00f3dulo Portal Workflow en Liferay Portal versiones 7.3.2 y anteriores, y Liferay DXP versiones 7.0 anterior a fix pack 93, versiones 7.1 anterior a fix pack 19 y versiones 7.2 anterior a fix pack 7, unas contrase\u00f1as de texto sin cifrar de usuarios son almacenadas en la base de datos si el flujo de trabajo est\u00e1 habilitado para la creaci\u00f3n de usuarios, que permite a atacantes con acceso a la base de datos obtener la contrase\u00f1a de un usuario"
}
],
"id": "CVE-2021-33325",
"lastModified": "2024-11-21T06:08:41.650",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 4.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"exploitabilityScore": 1.2,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2021-08-03T19:15:08.720",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://issues.liferay.com/browse/LPE-17042"
},
{
"source": "cve@mitre.org",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120748389"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://issues.liferay.com/browse/LPE-17042"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120748389"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-312"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2023-06-15 04:15
Modified
2024-11-21 08:07
Severity ?
6.1 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
6.1 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
6.1 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Summary
Open redirect vulnerability in the Layout module's SEO configuration in Liferay Portal 7.4.3.70 through 7.4.3.76, and Liferay DXP 7.4 update 70 through 76 allows remote attackers to redirect users to arbitrary external URLs via the `_com_liferay_layout_admin_web_portlet_GroupPagesPortlet_backURL` parameter.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_70:*:*:*:*:*:*",
"matchCriteriaId": "3A210A40-99B5-40D6-BBB8-E0E30FADED2E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_71:*:*:*:*:*:*",
"matchCriteriaId": "9ED1C984-729C-4994-B041-12AD82ABB7FB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_72:*:*:*:*:*:*",
"matchCriteriaId": "998F01FB-913B-4224-8413-D62ACCF570E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_73:*:*:*:*:*:*",
"matchCriteriaId": "F18E6353-E96E-4FD6-8CEE-28A30C70AC82",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_74:*:*:*:*:*:*",
"matchCriteriaId": "6102A1C7-26E5-4830-A87F-C7142671261E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_75:*:*:*:*:*:*",
"matchCriteriaId": "57374266-D3DA-4E50-8B4B-19ED8343AC9D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_76:*:*:*:*:*:*",
"matchCriteriaId": "93CCCAAE-8B59-4F59-91E9-860F4313521C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:*",
"matchCriteriaId": "D9014083-2E75-4403-9C1D-C4F07C8DB877",
"versionEndExcluding": "7.4.3.77",
"versionStartIncluding": "7.4.3.70",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Open redirect vulnerability in the Layout module\u0027s SEO configuration in Liferay Portal 7.4.3.70 through 7.4.3.76, and Liferay DXP 7.4 update 70 through 76 allows remote attackers to redirect users to arbitrary external URLs via the `_com_liferay_layout_admin_web_portlet_GroupPagesPortlet_backURL` parameter."
}
],
"id": "CVE-2023-35029",
"lastModified": "2024-11-21T08:07:50.590",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 2.7,
"source": "security@liferay.com",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2023-06-15T04:15:34.513",
"references": [
{
"source": "security@liferay.com",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-35029"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-35029"
}
],
"sourceIdentifier": "security@liferay.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-601"
}
],
"source": "security@liferay.com",
"type": "Secondary"
},
{
"description": [
{
"lang": "en",
"value": "CWE-601"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2021-05-16 16:15
Modified
2024-11-21 06:00
Severity ?
Summary
The JSON web services in Liferay Portal 7.3.4 and earlier, and Liferay DXP 7.0 before fix pack 97, 7.1 before fix pack 20 and 7.2 before fix pack 10 may provide overly verbose error messages, which allows remote attackers to use the contents of error messages to help launch another, more focused attacks via crafted inputs.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:liferay:dxp:*:*:*:*:*:*:*:*",
"matchCriteriaId": "78032EA3-6397-41E7-9757-5A1D86538B09",
"versionEndExcluding": "7.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:-:*:*:*:*:*:*",
"matchCriteriaId": "43A92274-7D88-4F0F-8265-CF862011F27F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_13:*:*:*:*:*:*",
"matchCriteriaId": "4874012D-52AA-4C32-95E9-BD331225B4E6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_14:*:*:*:*:*:*",
"matchCriteriaId": "21CAF86F-CEC9-44EE-BAF8-0F7AF9D945F5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_24:*:*:*:*:*:*",
"matchCriteriaId": "EF6C9F29-EEFF-4737-BD50-58572D6C14E9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_25:*:*:*:*:*:*",
"matchCriteriaId": "D24E1FA0-BD94-4AFC-92BF-AEDEBC7DCF4B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_26:*:*:*:*:*:*",
"matchCriteriaId": "FF9B54EE-973B-44B4-8EA2-B58FA49AC561",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_27:*:*:*:*:*:*",
"matchCriteriaId": "A9637223-557D-474B-A46B-D276866376C3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_28:*:*:*:*:*:*",
"matchCriteriaId": "F6306F9C-99DE-4F94-8E7F-6747762BEC45",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_3\\+:*:*:*:*:*:*",
"matchCriteriaId": "2DFF08F0-77C1-43A0-B7DD-9B905BE074EB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_30:*:*:*:*:*:*",
"matchCriteriaId": "48B7015C-26B9-453E-B3CF-9B220D3A8024",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_33:*:*:*:*:*:*",
"matchCriteriaId": "0FEB6921-3C45-4B7E-8B34-CDC34984583D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_35:*:*:*:*:*:*",
"matchCriteriaId": "525F45DC-2E5C-46A8-AEDF-9D6B8FA2EB11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_36:*:*:*:*:*:*",
"matchCriteriaId": "55755D0C-4C0C-42D9-BE5E-5D33C8BA4C7F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_39:*:*:*:*:*:*",
"matchCriteriaId": "FB4FE0F9-EB19-45D7-A953-674629D951F5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_40:*:*:*:*:*:*",
"matchCriteriaId": "22E4B63F-01A9-4F85-92BC-A51F41BE4121",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_41:*:*:*:*:*:*",
"matchCriteriaId": "23BE441D-8770-4F4D-86CD-4E53161F54FB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_42:*:*:*:*:*:*",
"matchCriteriaId": "E14FF010-3907-4C79-B945-C792E446CB31",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_43:*:*:*:*:*:*",
"matchCriteriaId": "B97B5817-B55E-485D-9747-3A50CF7245C8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_44:*:*:*:*:*:*",
"matchCriteriaId": "19EBD671-56BD-45D3-9248-DAF3F47B36FD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_45:*:*:*:*:*:*",
"matchCriteriaId": "93EDC2A1-9622-44DB-ABA8-754D61B60787",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_46:*:*:*:*:*:*",
"matchCriteriaId": "B4B6A06D-C323-431C-9A65-4FD6A6E4CAB6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_47:*:*:*:*:*:*",
"matchCriteriaId": "EE6D4466-1C3A-4D5A-A65C-A30A87EADF1A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_48:*:*:*:*:*:*",
"matchCriteriaId": "4F0BC40A-8E13-4665-A2E4-F5815CA70E17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_49:*:*:*:*:*:*",
"matchCriteriaId": "11FB69C3-7755-495A-AB76-201AF4D9623B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_50:*:*:*:*:*:*",
"matchCriteriaId": "FF66F652-6C08-4D47-865D-36E70360B632",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_51:*:*:*:*:*:*",
"matchCriteriaId": "17B68D59-0509-4C6A-B803-03A02EB76F1F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_52:*:*:*:*:*:*",
"matchCriteriaId": "8F69B287-3B86-4B64-BCB4-40E9495A628D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_53:*:*:*:*:*:*",
"matchCriteriaId": "C627090E-A1BF-4332-9538-EE4E184DB65E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_54:*:*:*:*:*:*",
"matchCriteriaId": "9A089471-9944-4C75-A25F-1F23C18C0CF0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_56:*:*:*:*:*:*",
"matchCriteriaId": "B90E7FBF-6B5B-457A-8B20-ECA69A626BB8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_57:*:*:*:*:*:*",
"matchCriteriaId": "1975C1AB-EF50-42E2-9879-17FB763B45F9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_58:*:*:*:*:*:*",
"matchCriteriaId": "DFB7BB13-773B-47A6-A001-B9EBA46C917E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_59:*:*:*:*:*:*",
"matchCriteriaId": "1C4A2D39-3725-4E80-9F3F-AC1F4EE662E8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_60:*:*:*:*:*:*",
"matchCriteriaId": "BAEDF88B-B9C8-4891-B199-A72C066FC7BF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_61:*:*:*:*:*:*",
"matchCriteriaId": "F768E1DD-3DC6-4783-82DE-D089C7CD3C63",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_64:*:*:*:*:*:*",
"matchCriteriaId": "426EDA92-FE5A-4523-8AAE-1E5D5D67F535",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_65:*:*:*:*:*:*",
"matchCriteriaId": "070CB609-6D4B-4817-9F91-00BD62423E56",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_66:*:*:*:*:*:*",
"matchCriteriaId": "FEE87846-A4CF-47E5-93AA-5D7E2548D28D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_67:*:*:*:*:*:*",
"matchCriteriaId": "A4C11B0E-6D94-4A65-83BE-1E5828710CB9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_68:*:*:*:*:*:*",
"matchCriteriaId": "F1DC73B1-4017-424F-A28D-F54F2FA8ED8C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_69:*:*:*:*:*:*",
"matchCriteriaId": "32B4FD3C-7BB7-4DA2-9A3A-05A6370B9745",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_70:*:*:*:*:*:*",
"matchCriteriaId": "71293E5B-4DCC-47BC-A493-3540D57E6067",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_71:*:*:*:*:*:*",
"matchCriteriaId": "56A8940B-318E-4C6A-9131-A50E90E82C28",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_72:*:*:*:*:*:*",
"matchCriteriaId": "F09B5E82-DC18-4B07-9A05-E433579B4FB5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_73:*:*:*:*:*:*",
"matchCriteriaId": "CE25D189-2D6F-4229-BF09-2CEA0A6C5D50",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_75:*:*:*:*:*:*",
"matchCriteriaId": "36549BE5-DEDB-408A-BFC9-AB00031D45DD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_76:*:*:*:*:*:*",
"matchCriteriaId": "E11B8075-4212-41CB-85AC-09FA1CDB86A1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_78:*:*:*:*:*:*",
"matchCriteriaId": "80412DCE-D79F-492A-8788-6A43C4D76D7C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_79:*:*:*:*:*:*",
"matchCriteriaId": "BC7A939F-21D1-4AF1-BAB9-E91DFCFFB7A2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_80:*:*:*:*:*:*",
"matchCriteriaId": "5F2240FC-EDDC-47F5-B713-07FF2D23CE00",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_81:*:*:*:*:*:*",
"matchCriteriaId": "5006AAE4-B154-468A-850C-20171965E2AC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_82:*:*:*:*:*:*",
"matchCriteriaId": "1541072D-3F14-47A2-8A42-EF2765643AE4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_83:*:*:*:*:*:*",
"matchCriteriaId": "2340C85F-0296-4591-8D23-56634C50C5F8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_84:*:*:*:*:*:*",
"matchCriteriaId": "6BEC3C5C-DA8C-4620-A38E-BB47D4CB7CBA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_85:*:*:*:*:*:*",
"matchCriteriaId": "6DD38B1F-7EEA-4DB5-A31B-D84DC33313FA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_86:*:*:*:*:*:*",
"matchCriteriaId": "FC923A9E-CF9D-44DE-AB58-7BCAAFDDE7D6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_87:*:*:*:*:*:*",
"matchCriteriaId": "65542031-04E1-485F-8102-04CB65865ECE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_88:*:*:*:*:*:*",
"matchCriteriaId": "B36F2FBD-E949-4608-9ECF-0F05DD8E487E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_89:*:*:*:*:*:*",
"matchCriteriaId": "D68832F1-6D71-4A63-AA8A-86C0EDF9F8E1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_90:*:*:*:*:*:*",
"matchCriteriaId": "FD1F579A-084C-46A9-ADCA-8F3FA45D85D6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_91:*:*:*:*:*:*",
"matchCriteriaId": "FC81C494-F68E-4580-87FB-7792C1080DFC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_92:*:*:*:*:*:*",
"matchCriteriaId": "6693594D-6731-4223-8C28-4873746B97AB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_93:*:*:*:*:*:*",
"matchCriteriaId": "0B96CDC5-F4DE-49A2-B09D-318163EC9A09",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_94:*:*:*:*:*:*",
"matchCriteriaId": "EEAE13AF-DEEE-4284-A93D-EFE2647E12FB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_95:*:*:*:*:*:*",
"matchCriteriaId": "9EEADDC3-C436-452F-9271-8F30A9D03FE6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_96:*:*:*:*:*:*",
"matchCriteriaId": "A775E68D-A18E-433F-A9D0-AB6E71495936",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:-:*:*:*:*:*:*",
"matchCriteriaId": "C2AA7E18-A41B-4F0D-A04F-57C5745D091B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_1:*:*:*:*:*:*",
"matchCriteriaId": "392B783D-620D-4C71-AAA0-848B16964A27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_10:*:*:*:*:*:*",
"matchCriteriaId": "4F5A94E2-22B7-4D2D-A491-29F395E727C5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_11:*:*:*:*:*:*",
"matchCriteriaId": "E9B10908-C42B-4763-9D47-236506B0E84A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_12:*:*:*:*:*:*",
"matchCriteriaId": "CF544435-36AC-49B8-BA50-A6B6D1678BBC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_13:*:*:*:*:*:*",
"matchCriteriaId": "9D265542-5333-4CCD-90E5-B5F6A55F9863",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_14:*:*:*:*:*:*",
"matchCriteriaId": "1763CD8B-3ACD-4617-A1CA-B9F77A074977",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_15:*:*:*:*:*:*",
"matchCriteriaId": "F25C66AA-B60D-413C-A848-51E12D6080AC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_16:*:*:*:*:*:*",
"matchCriteriaId": "071A0D53-EC95-4B18-9FA3-55208B1F7B94",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_17:*:*:*:*:*:*",
"matchCriteriaId": "CC26A9D4-14D6-46B1-BB00-A2C4386EBCA4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_18:*:*:*:*:*:*",
"matchCriteriaId": "350CDEDA-9A20-4BC3-BEAE-8346CED10CD6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_19:*:*:*:*:*:*",
"matchCriteriaId": "10C6107E-79B3-4672-B3E5-8A2FA9A829CF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_2:*:*:*:*:*:*",
"matchCriteriaId": "3233D306-3F8E-40A4-B132-7264E63DD131",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_3:*:*:*:*:*:*",
"matchCriteriaId": "9EAEA45A-0370-475E-B4CB-395A434DC3A1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_4:*:*:*:*:*:*",
"matchCriteriaId": "39310F05-1DB6-43BA-811C-9CB91D6DCF20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_5:*:*:*:*:*:*",
"matchCriteriaId": "D6135B16-C89E-4F49-BA15-823E2AF26D68",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_6:*:*:*:*:*:*",
"matchCriteriaId": "CC887BEC-915B-44AC-B473-5448B3D8DCF7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_7:*:*:*:*:*:*",
"matchCriteriaId": "D7A7CC60-C294-41EC-B000-D15AAA93A3D5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_8:*:*:*:*:*:*",
"matchCriteriaId": "022132F8-6E56-4A29-95D6-3B7861D39CDF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_9:*:*:*:*:*:*",
"matchCriteriaId": "651DA9B7-9C11-47A7-AF5C-95625C8FFF6A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:-:*:*:*:*:*:*",
"matchCriteriaId": "8CAAE1B7-982E-4D50-9651-DEEE6CD74EED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_1:*:*:*:*:*:*",
"matchCriteriaId": "AFCF99EC-3384-418D-A419-B9DB607BE371",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_2:*:*:*:*:*:*",
"matchCriteriaId": "31E05134-A0C5-4937-A228-7D0884276B67",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_3:*:*:*:*:*:*",
"matchCriteriaId": "3F06C4AD-FD20-4345-8386-0895312F0A00",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_4:*:*:*:*:*:*",
"matchCriteriaId": "98CC25E2-EC3D-43A2-8D03-06F0E804EA63",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_5:*:*:*:*:*:*",
"matchCriteriaId": "30933C36-C710-488F-9601-EE1BB749C58A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_6:*:*:*:*:*:*",
"matchCriteriaId": "41E94372-A1AE-48B1-82DC-08B7B616473F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_7:*:*:*:*:*:*",
"matchCriteriaId": "51FBC8E0-34F8-475C-A1A8-571791CA05F9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_8:*:*:*:*:*:*",
"matchCriteriaId": "1E73EAEA-FA88-46B9-B9D5-A41603957AD7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_9:*:*:*:*:*:*",
"matchCriteriaId": "CF9BC654-4E3F-4B40-A6E5-79A818A51BED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:*",
"matchCriteriaId": "5513FCC4-B6FB-4C86-81E6-05059FCD8DEB",
"versionEndIncluding": "7.3.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The JSON web services in Liferay Portal 7.3.4 and earlier, and Liferay DXP 7.0 before fix pack 97, 7.1 before fix pack 20 and 7.2 before fix pack 10 may provide overly verbose error messages, which allows remote attackers to use the contents of error messages to help launch another, more focused attacks via crafted inputs."
},
{
"lang": "es",
"value": "Los servicios web JSON en Liferay Portal versiones 7.3.4 y anteriores, y Liferay DXP versiones 7.0 anteriores al fixpack 97, versiones 7.1 anteriores al fixpack 20 y versiones 7.2 anteriores al fixpack 10, pueden proporcionar mensajes de error demasiado detallados, lo que permite a atacantes remotos usar el contenido del error de mensajes para ayudar a lanzar otros ataques m\u00e1s enfocados por medio de entradas dise\u00f1adas"
}
],
"id": "CVE-2021-29040",
"lastModified": "2024-11-21T06:00:34.533",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 1.4,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2021-05-16T16:15:07.213",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://liferay.com"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120743429"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://liferay.com"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120743429"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-209"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2022-09-22 00:15
Modified
2024-11-21 07:18
Severity ?
Summary
The Layout module in Liferay Portal v7.3.3 through v7.4.3.34, and Liferay DXP 7.3 before update 10, and 7.4 before update 35 does not check user permission before showing the preview of a "Content Page" type page, allowing attackers to view unpublished "Content Page" pages via URL manipulation.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| liferay | dxp | 7.3 | |
| liferay | dxp | 7.3 | |
| liferay | dxp | 7.3 | |
| liferay | dxp | 7.3 | |
| liferay | dxp | 7.3 | |
| liferay | dxp | 7.3 | |
| liferay | dxp | 7.3 | |
| liferay | dxp | 7.3 | |
| liferay | dxp | 7.3 | |
| liferay | dxp | 7.3 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | dxp | 7.4 | |
| liferay | liferay_portal | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:liferay:dxp:7.3:-:*:*:*:*:*:*",
"matchCriteriaId": "21C55D41-DB66-494D-BEEB-BDAC7CB4B31B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.3:update_1:*:*:*:*:*:*",
"matchCriteriaId": "D60CDAA3-6029-4904-9D08-BB221BCFD7C3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.3:update_2:*:*:*:*:*:*",
"matchCriteriaId": "B66F47E9-3D82-497E-BD84-E47A65FAF8C3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.3:update_3:*:*:*:*:*:*",
"matchCriteriaId": "A0BA4856-59DF-427C-959F-3B836314F5D5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.3:update_4:*:*:*:*:*:*",
"matchCriteriaId": "F3A5ADE1-4743-4A78-9FCC-CEB857012A5B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.3:update_5:*:*:*:*:*:*",
"matchCriteriaId": "2B420A18-5C8B-470F-9189-C84F8DAA74D5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.3:update_6:*:*:*:*:*:*",
"matchCriteriaId": "A7A399C4-6D4B-438C-9BAE-2893E457028A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.3:update_7:*:*:*:*:*:*",
"matchCriteriaId": "0CBACD88-B4F8-4496-9706-C666768AC9B9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.3:update_8:*:*:*:*:*:*",
"matchCriteriaId": "510C440D-8B79-4685-8105-7A21A77CFC61",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.3:update_9:*:*:*:*:*:*",
"matchCriteriaId": "89C1DF64-7F4B-4231-A0F5-E4760D7CE008",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_1:*:*:*:*:*:*",
"matchCriteriaId": "46AF397F-A95C-4FAD-A6EA-CB623B7A262A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_10:*:*:*:*:*:*",
"matchCriteriaId": "3B8C3B3F-1BBB-47A5-A789-B207B6346FFF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_11:*:*:*:*:*:*",
"matchCriteriaId": "AD5D1171-954A-4E75-813D-E8392CFE4029",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_12:*:*:*:*:*:*",
"matchCriteriaId": "F148098A-D867-4C8B-9632-6B7F24D50C30",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_13:*:*:*:*:*:*",
"matchCriteriaId": "8A112ED2-27C2-45E3-8FA0-6043F7D3BEED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_14:*:*:*:*:*:*",
"matchCriteriaId": "0744AC04-9663-4DA1-9657-EC5BF0C68499",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_15:*:*:*:*:*:*",
"matchCriteriaId": "5703FE2B-011A-4A40-AB67-B989438F2183",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_16:*:*:*:*:*:*",
"matchCriteriaId": "41A54448-B1AB-4E92-8523-5D4A46A83533",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_17:*:*:*:*:*:*",
"matchCriteriaId": "A96A2A4A-3EB3-4074-A846-EC6EECC04B43",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_18:*:*:*:*:*:*",
"matchCriteriaId": "56DAE678-10B9-419D-9F5D-96E3AC3A6E4A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_19:*:*:*:*:*:*",
"matchCriteriaId": "064F4C28-B1F5-44C2-91AA-A09FD56EC0B9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_2:*:*:*:*:*:*",
"matchCriteriaId": "C2C2351E-BDEE-4A79-A00C-6520B54996EF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_20:*:*:*:*:*:*",
"matchCriteriaId": "814D0CE3-B89F-423C-B1E3-47BD0A474491",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_21:*:*:*:*:*:*",
"matchCriteriaId": "58DB7C5A-B4E3-410A-B491-3F322B340BDF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_22:*:*:*:*:*:*",
"matchCriteriaId": "86B581B6-02B0-40B9-BB5C-E28FC51042DB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_23:*:*:*:*:*:*",
"matchCriteriaId": "E7EFBC14-6785-4435-BA96-D77A857BC1C8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_24:*:*:*:*:*:*",
"matchCriteriaId": "585635F8-53DC-4F64-BF6B-C6F72A5F4D29",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_25:*:*:*:*:*:*",
"matchCriteriaId": "355DD7FC-E9C7-43D6-8313-0474AB314F18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_26:*:*:*:*:*:*",
"matchCriteriaId": "B0FDE8B1-444A-4FEB-AC97-4B29C914EB8A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_27:*:*:*:*:*:*",
"matchCriteriaId": "683D063A-0E32-4E2D-8CBF-A57F45071F6E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_28:*:*:*:*:*:*",
"matchCriteriaId": "7DFEBCAB-1D9B-4BED-A2C6-11BA863F1EE9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_29:*:*:*:*:*:*",
"matchCriteriaId": "DB8733C4-8CE4-4E4B-A2AE-919AA69DAF8E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_3:*:*:*:*:*:*",
"matchCriteriaId": "25F5C3E9-CBB0-4114-91A4-41F0E666026A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_30:*:*:*:*:*:*",
"matchCriteriaId": "D372D9B9-5A83-4FF8-8DE5-617D99D1A8B5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_31:*:*:*:*:*:*",
"matchCriteriaId": "7519ABB1-57A7-46F1-97FC-DD44787F2B6E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_32:*:*:*:*:*:*",
"matchCriteriaId": "87BD916B-245C-4D62-B595-1985784C2ABC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_33:*:*:*:*:*:*",
"matchCriteriaId": "841E15A8-0819-4E48-B7E3-3ACCB4C1F43B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_34:*:*:*:*:*:*",
"matchCriteriaId": "91A243D9-7633-4836-B72D-75EF6C0F8876",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_4:*:*:*:*:*:*",
"matchCriteriaId": "5E2B5687-B311-460E-A562-D754AF271F8E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_5:*:*:*:*:*:*",
"matchCriteriaId": "B49D0CB9-8ED7-46AB-9BA5-7235A2CD9117",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_6:*:*:*:*:*:*",
"matchCriteriaId": "DF169364-096C-4294-B89F-C07AF1DCC9C4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_7:*:*:*:*:*:*",
"matchCriteriaId": "30CB2C54-1A20-4226-ACC6-AC8131899AE2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_8:*:*:*:*:*:*",
"matchCriteriaId": "65693260-5B0F-47AA-BF08-D2979997A40A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_9:*:*:*:*:*:*",
"matchCriteriaId": "C9116909-04C3-4040-B945-4A6225425520",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:*",
"matchCriteriaId": "A3D3F7B7-C39B-48E5-AD3A-1399B405F97B",
"versionEndExcluding": "7.4.3.35",
"versionStartIncluding": "7.3.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The Layout module in Liferay Portal v7.3.3 through v7.4.3.34, and Liferay DXP 7.3 before update 10, and 7.4 before update 35 does not check user permission before showing the preview of a \"Content Page\" type page, allowing attackers to view unpublished \"Content Page\" pages via URL manipulation."
},
{
"lang": "es",
"value": "El m\u00f3dulo Layout en Liferay Portal versiones v7.3.3 hasta v7.4.3.34, y Liferay DXP versiones 7.3 anteriores a update 10, y 7.4 anteriores a update 35, no comprueba el permiso del usuario antes de mostrar la vista previa de una p\u00e1gina de tipo \"Content Page\", permitiendo a atacantes visualizar p\u00e1ginas de tipo \"Content Page\" no publicadas por medio de la manipulaci\u00f3n de la URL"
}
],
"id": "CVE-2022-39975",
"lastModified": "2024-11-21T07:18:35.047",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 1.4,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2022-09-22T00:15:10.310",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Product"
],
"url": "http://liferay.com"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-39975"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Product"
],
"url": "http://liferay.com"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-39975"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-862"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2023-06-15 04:15
Modified
2024-11-21 08:16
Severity ?
6.1 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
6.1 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
6.1 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Summary
Cross-site scripting (XSS) vulnerability in the Layout module's SEO configuration in Liferay Portal 7.4.3.70 through 7.4.3.73, and Liferay DXP 7.4 update 70 through 73 allows remote attackers to inject arbitrary web script or HTML via the `_com_liferay_layout_admin_web_portlet_GroupPagesPortlet_backURL` parameter.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_70:*:*:*:*:*:*",
"matchCriteriaId": "3A210A40-99B5-40D6-BBB8-E0E30FADED2E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_71:*:*:*:*:*:*",
"matchCriteriaId": "9ED1C984-729C-4994-B041-12AD82ABB7FB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_72:*:*:*:*:*:*",
"matchCriteriaId": "998F01FB-913B-4224-8413-D62ACCF570E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.4:update_73:*:*:*:*:*:*",
"matchCriteriaId": "F18E6353-E96E-4FD6-8CEE-28A30C70AC82",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:*",
"matchCriteriaId": "26978230-332C-41AA-9F5D-CFF598640EEC",
"versionEndExcluding": "7.4.3.74",
"versionStartIncluding": "7.4.3.70",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in the Layout module\u0027s SEO configuration in Liferay Portal 7.4.3.70 through 7.4.3.73, and Liferay DXP 7.4 update 70 through 73 allows remote attackers to inject arbitrary web script or HTML via the `_com_liferay_layout_admin_web_portlet_GroupPagesPortlet_backURL` parameter."
}
],
"id": "CVE-2023-3193",
"lastModified": "2024-11-21T08:16:39.987",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 2.7,
"source": "security@liferay.com",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2023-06-15T04:15:34.727",
"references": [
{
"source": "security@liferay.com",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-3193"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-3193"
}
],
"sourceIdentifier": "security@liferay.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "security@liferay.com",
"type": "Secondary"
},
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2020-07-20 02:15
Modified
2024-11-21 05:06
Severity ?
8.1 (High) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
8.1 (High) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
8.1 (High) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Summary
Liferay Portal before 7.3.0, and Liferay DXP 7.0 before fix pack 90, 7.1 before fix pack 17, and 7.2 before fix pack 5, allows man-in-the-middle attackers to execute arbitrary code via crafted serialized payloads, because of insecure deserialization.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | https://issues.liferay.com/browse/LPE-16963 | Issue Tracking, Vendor Advisory | |
| cve@mitre.org | https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/119317427 | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://issues.liferay.com/browse/LPE-16963 | Issue Tracking, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/119317427 | Vendor Advisory |
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:-:*:*:*:*:*:*",
"matchCriteriaId": "43A92274-7D88-4F0F-8265-CF862011F27F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_13:*:*:*:*:*:*",
"matchCriteriaId": "4874012D-52AA-4C32-95E9-BD331225B4E6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_14:*:*:*:*:*:*",
"matchCriteriaId": "21CAF86F-CEC9-44EE-BAF8-0F7AF9D945F5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_24:*:*:*:*:*:*",
"matchCriteriaId": "EF6C9F29-EEFF-4737-BD50-58572D6C14E9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_25:*:*:*:*:*:*",
"matchCriteriaId": "D24E1FA0-BD94-4AFC-92BF-AEDEBC7DCF4B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_26:*:*:*:*:*:*",
"matchCriteriaId": "FF9B54EE-973B-44B4-8EA2-B58FA49AC561",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_27:*:*:*:*:*:*",
"matchCriteriaId": "A9637223-557D-474B-A46B-D276866376C3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_28:*:*:*:*:*:*",
"matchCriteriaId": "F6306F9C-99DE-4F94-8E7F-6747762BEC45",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_3\\+:*:*:*:*:*:*",
"matchCriteriaId": "2DFF08F0-77C1-43A0-B7DD-9B905BE074EB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_30:*:*:*:*:*:*",
"matchCriteriaId": "48B7015C-26B9-453E-B3CF-9B220D3A8024",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_33:*:*:*:*:*:*",
"matchCriteriaId": "0FEB6921-3C45-4B7E-8B34-CDC34984583D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_35:*:*:*:*:*:*",
"matchCriteriaId": "525F45DC-2E5C-46A8-AEDF-9D6B8FA2EB11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_36:*:*:*:*:*:*",
"matchCriteriaId": "55755D0C-4C0C-42D9-BE5E-5D33C8BA4C7F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_39:*:*:*:*:*:*",
"matchCriteriaId": "FB4FE0F9-EB19-45D7-A953-674629D951F5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_40:*:*:*:*:*:*",
"matchCriteriaId": "22E4B63F-01A9-4F85-92BC-A51F41BE4121",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_41:*:*:*:*:*:*",
"matchCriteriaId": "23BE441D-8770-4F4D-86CD-4E53161F54FB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_42:*:*:*:*:*:*",
"matchCriteriaId": "E14FF010-3907-4C79-B945-C792E446CB31",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_43:*:*:*:*:*:*",
"matchCriteriaId": "B97B5817-B55E-485D-9747-3A50CF7245C8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_44:*:*:*:*:*:*",
"matchCriteriaId": "19EBD671-56BD-45D3-9248-DAF3F47B36FD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_45:*:*:*:*:*:*",
"matchCriteriaId": "93EDC2A1-9622-44DB-ABA8-754D61B60787",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_46:*:*:*:*:*:*",
"matchCriteriaId": "B4B6A06D-C323-431C-9A65-4FD6A6E4CAB6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_47:*:*:*:*:*:*",
"matchCriteriaId": "EE6D4466-1C3A-4D5A-A65C-A30A87EADF1A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_48:*:*:*:*:*:*",
"matchCriteriaId": "4F0BC40A-8E13-4665-A2E4-F5815CA70E17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_49:*:*:*:*:*:*",
"matchCriteriaId": "11FB69C3-7755-495A-AB76-201AF4D9623B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_50:*:*:*:*:*:*",
"matchCriteriaId": "FF66F652-6C08-4D47-865D-36E70360B632",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_51:*:*:*:*:*:*",
"matchCriteriaId": "17B68D59-0509-4C6A-B803-03A02EB76F1F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_52:*:*:*:*:*:*",
"matchCriteriaId": "8F69B287-3B86-4B64-BCB4-40E9495A628D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_53:*:*:*:*:*:*",
"matchCriteriaId": "C627090E-A1BF-4332-9538-EE4E184DB65E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_54:*:*:*:*:*:*",
"matchCriteriaId": "9A089471-9944-4C75-A25F-1F23C18C0CF0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_56:*:*:*:*:*:*",
"matchCriteriaId": "B90E7FBF-6B5B-457A-8B20-ECA69A626BB8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_57:*:*:*:*:*:*",
"matchCriteriaId": "1975C1AB-EF50-42E2-9879-17FB763B45F9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_58:*:*:*:*:*:*",
"matchCriteriaId": "DFB7BB13-773B-47A6-A001-B9EBA46C917E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_59:*:*:*:*:*:*",
"matchCriteriaId": "1C4A2D39-3725-4E80-9F3F-AC1F4EE662E8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_60:*:*:*:*:*:*",
"matchCriteriaId": "BAEDF88B-B9C8-4891-B199-A72C066FC7BF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_61:*:*:*:*:*:*",
"matchCriteriaId": "F768E1DD-3DC6-4783-82DE-D089C7CD3C63",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_64:*:*:*:*:*:*",
"matchCriteriaId": "426EDA92-FE5A-4523-8AAE-1E5D5D67F535",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_65:*:*:*:*:*:*",
"matchCriteriaId": "070CB609-6D4B-4817-9F91-00BD62423E56",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_66:*:*:*:*:*:*",
"matchCriteriaId": "FEE87846-A4CF-47E5-93AA-5D7E2548D28D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_67:*:*:*:*:*:*",
"matchCriteriaId": "A4C11B0E-6D94-4A65-83BE-1E5828710CB9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_68:*:*:*:*:*:*",
"matchCriteriaId": "F1DC73B1-4017-424F-A28D-F54F2FA8ED8C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_69:*:*:*:*:*:*",
"matchCriteriaId": "32B4FD3C-7BB7-4DA2-9A3A-05A6370B9745",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_70:*:*:*:*:*:*",
"matchCriteriaId": "71293E5B-4DCC-47BC-A493-3540D57E6067",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_71:*:*:*:*:*:*",
"matchCriteriaId": "56A8940B-318E-4C6A-9131-A50E90E82C28",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_72:*:*:*:*:*:*",
"matchCriteriaId": "F09B5E82-DC18-4B07-9A05-E433579B4FB5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_73:*:*:*:*:*:*",
"matchCriteriaId": "CE25D189-2D6F-4229-BF09-2CEA0A6C5D50",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_75:*:*:*:*:*:*",
"matchCriteriaId": "36549BE5-DEDB-408A-BFC9-AB00031D45DD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_76:*:*:*:*:*:*",
"matchCriteriaId": "E11B8075-4212-41CB-85AC-09FA1CDB86A1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_78:*:*:*:*:*:*",
"matchCriteriaId": "80412DCE-D79F-492A-8788-6A43C4D76D7C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_79:*:*:*:*:*:*",
"matchCriteriaId": "BC7A939F-21D1-4AF1-BAB9-E91DFCFFB7A2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_80:*:*:*:*:*:*",
"matchCriteriaId": "5F2240FC-EDDC-47F5-B713-07FF2D23CE00",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.0:fix_pack_81:*:*:*:*:*:*",
"matchCriteriaId": "5006AAE4-B154-468A-850C-20171965E2AC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:-:*:*:*:*:*:*",
"matchCriteriaId": "C2AA7E18-A41B-4F0D-A04F-57C5745D091B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_1:*:*:*:*:*:*",
"matchCriteriaId": "392B783D-620D-4C71-AAA0-848B16964A27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_10:*:*:*:*:*:*",
"matchCriteriaId": "4F5A94E2-22B7-4D2D-A491-29F395E727C5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_11:*:*:*:*:*:*",
"matchCriteriaId": "E9B10908-C42B-4763-9D47-236506B0E84A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_12:*:*:*:*:*:*",
"matchCriteriaId": "CF544435-36AC-49B8-BA50-A6B6D1678BBC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_13:*:*:*:*:*:*",
"matchCriteriaId": "9D265542-5333-4CCD-90E5-B5F6A55F9863",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_14:*:*:*:*:*:*",
"matchCriteriaId": "1763CD8B-3ACD-4617-A1CA-B9F77A074977",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_15:*:*:*:*:*:*",
"matchCriteriaId": "F25C66AA-B60D-413C-A848-51E12D6080AC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_16:*:*:*:*:*:*",
"matchCriteriaId": "071A0D53-EC95-4B18-9FA3-55208B1F7B94",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_2:*:*:*:*:*:*",
"matchCriteriaId": "3233D306-3F8E-40A4-B132-7264E63DD131",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_3:*:*:*:*:*:*",
"matchCriteriaId": "9EAEA45A-0370-475E-B4CB-395A434DC3A1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_4:*:*:*:*:*:*",
"matchCriteriaId": "39310F05-1DB6-43BA-811C-9CB91D6DCF20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_5:*:*:*:*:*:*",
"matchCriteriaId": "D6135B16-C89E-4F49-BA15-823E2AF26D68",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_6:*:*:*:*:*:*",
"matchCriteriaId": "CC887BEC-915B-44AC-B473-5448B3D8DCF7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_7:*:*:*:*:*:*",
"matchCriteriaId": "D7A7CC60-C294-41EC-B000-D15AAA93A3D5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_8:*:*:*:*:*:*",
"matchCriteriaId": "022132F8-6E56-4A29-95D6-3B7861D39CDF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.1:fix_pack_9:*:*:*:*:*:*",
"matchCriteriaId": "651DA9B7-9C11-47A7-AF5C-95625C8FFF6A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:-:*:*:*:*:*:*",
"matchCriteriaId": "8CAAE1B7-982E-4D50-9651-DEEE6CD74EED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_1:*:*:*:*:*:*",
"matchCriteriaId": "AFCF99EC-3384-418D-A419-B9DB607BE371",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_2:*:*:*:*:*:*",
"matchCriteriaId": "31E05134-A0C5-4937-A228-7D0884276B67",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_3:*:*:*:*:*:*",
"matchCriteriaId": "3F06C4AD-FD20-4345-8386-0895312F0A00",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_4:*:*:*:*:*:*",
"matchCriteriaId": "98CC25E2-EC3D-43A2-8D03-06F0E804EA63",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_5:*:*:*:*:*:*",
"matchCriteriaId": "30933C36-C710-488F-9601-EE1BB749C58A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:*",
"matchCriteriaId": "8B61E29C-3071-41EF-9774-185F91282DEB",
"versionEndExcluding": "7.3.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Liferay Portal before 7.3.0, and Liferay DXP 7.0 before fix pack 90, 7.1 before fix pack 17, and 7.2 before fix pack 5, allows man-in-the-middle attackers to execute arbitrary code via crafted serialized payloads, because of insecure deserialization."
},
{
"lang": "es",
"value": "Liferay Portal versiones anteriores a 7.3.0, y Liferay DXP versi\u00f3n 7.0 anterior al papuete 90, versi\u00f3n 7.1 anterior al paquete de correcci\u00f3n 17, y versi\u00f3n 7.2 anterior al paquete de correcci\u00f3n 5, permite a los atacantes man-in-the-middle ejecutar c\u00f3digo arbitrario a trav\u00e9s de cargas \u00fatiles seriadas, debido a la deserializaci\u00f3n insegura"
}
],
"id": "CVE-2020-15842",
"lastModified": "2024-11-21T05:06:18.100",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 2.2,
"impactScore": 5.9,
"source": "cve@mitre.org",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 2.2,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2020-07-20T02:15:11.660",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Issue Tracking",
"Vendor Advisory"
],
"url": "https://issues.liferay.com/browse/LPE-16963"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/119317427"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Issue Tracking",
"Vendor Advisory"
],
"url": "https://issues.liferay.com/browse/LPE-16963"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/119317427"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-502"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2021-05-16 16:15
Modified
2024-11-21 06:00
Severity ?
Summary
The SimpleCaptcha implementation in Liferay Portal 7.3.4, 7.3.5 and Liferay DXP 7.3 before fix pack 1 does not invalidate CAPTCHA answers after it is used, which allows remote attackers to repeatedly perform actions protected by a CAPTCHA challenge by reusing the same CAPTCHA answer.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| liferay | dxp | * | |
| liferay | dxp | 7.3 | |
| liferay | liferay_portal | 7.3.4 | |
| liferay | liferay_portal | 7.3.5 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:liferay:dxp:*:*:*:*:*:*:*:*",
"matchCriteriaId": "5C0B6536-11D4-48A1-8EC8-FCDFFFD07540",
"versionEndExcluding": "7.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:dxp:7.3:-:*:*:*:*:*:*",
"matchCriteriaId": "21C55D41-DB66-494D-BEEB-BDAC7CB4B31B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:liferay_portal:7.3.4:*:*:*:*:*:*:*",
"matchCriteriaId": "2C673509-5436-44DF-AFCE-BE5C3188D62F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:liferay:liferay_portal:7.3.5:*:*:*:*:*:*:*",
"matchCriteriaId": "2B842A08-1EDB-4232-89C9-9B966E251B3B",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The SimpleCaptcha implementation in Liferay Portal 7.3.4, 7.3.5 and Liferay DXP 7.3 before fix pack 1 does not invalidate CAPTCHA answers after it is used, which allows remote attackers to repeatedly perform actions protected by a CAPTCHA challenge by reusing the same CAPTCHA answer."
},
{
"lang": "es",
"value": "La implementaci\u00f3n de SimpleCaptcha en Liferay Portal versiones 7.3.4, 7.3.5 y Liferay DXP versiones 7.3 anteriores al fixpack 1, no invalida las respuestas CAPTCHA despu\u00e9s de su uso, lo que permite a atacantes remotos llevar a cabo repetidamente acciones protegidas por un desaf\u00edo CAPTCHA reutilizando la misma respuesta CAPTCHA"
}
],
"id": "CVE-2021-29047",
"lastModified": "2024-11-21T06:00:35.473",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2021-05-16T16:15:07.297",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://liferay.com"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120743467"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://liferay.com"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120743467"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-287"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}