Vulnerability CVE-2019-6588

Vulnerability CVE-2019-6588

Published: 2019-06-03

Description:

In Liferay Portal before 7.1 CE GA4, an XSS vulnerability exists in the SimpleCaptcha API when custom code passes unsanitized input into the "url" parameter of the JSP taglib call <liferay-ui:captcha url="<%= url %>" /> or <liferay-captcha:captcha url="<%= url %>" />. Liferay Portal out-of-the-box behavior with no customizations is not vulnerable.

See advisories in our WLB2 database:

	Topic	Author	Date
Low	Liferay Portal 7.1 CE GA4 Cross Site Scripting	Valerio Brussani	13.06.2019

Type:

CWE-79

(Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'))

CVSS2 => (AV:N/AC:H/Au:N/C:N/I:P/A:N)

CVSS Base Score	Impact Subscore	Exploitability Subscore
2.6/10	2.9/10	4.9/10

Exploit range	Attack complexity	Authentication
Remote	High	No required
Confidentiality impact	Integrity impact	Availability impact
None	Partial	None

Affected software
Liferay -> Liferay portal

References:

http://packetstormsecurity.com/files/153252/Liferay-Portal-7.1-CE-GA4-Cross-Site-Scripting.html

https://dev.liferay.com/web/community-security-team/known-vulnerabilities/liferay-portal-71/-/asset_publisher/7v4O7y85hZMo/content/cst-7130-multiple-xss-vulnerabilities-in-7-1-ce-ga3

Vulnerability CVE-2019-6588

See advisories in our WLB2 database:

Low

Liferay Portal 7.1 CE GA4 Cross Site Scripting

CWE-79

CVSS2 => (AV:N/AC:H/Au:N/C:N/I:P/A:N)

2.6/10

2.9/10

4.9/10

Remote

High

No required

None

Partial

None

Affected software

References: