SB2019060325 - Cross-site scripting in Liferay Enterprise Portal

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2019060325

SB2019060325 - Cross-site scripting in Liferay Enterprise Portal

Published: June 3, 2019 Updated: August 8, 2020

Security Bulletin ID SB2019060325
CSH Severity
Low
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Cross-site scripting (CVE-ID: CVE-2019-6588)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:P/U:Clear


The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

In Liferay Portal before 7.1 CE GA4, an XSS vulnerability exists in the SimpleCaptcha API when custom code passes unsanitized input into the "url" parameter of the JSP taglib call <liferay-ui:captcha url="<%= url %>" /> or <liferay-captcha:captcha url="<%= url %>" />. Liferay Portal out-of-the-box behavior with no customizations is not vulnerable.


Remediation

Install update from vendor's website.

References