ID:5922 - Exploit for Cross-site scripting in Liferay Enterprise Portal - CVE-2019-6588

Link to public exploit:

Vulnerability description

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

In Liferay Portal before 7.1 CE GA4, an XSS vulnerability exists in the SimpleCaptcha API when custom code passes unsanitized input into the "url" parameter of the JSP taglib call <liferay-ui:captcha url="<%= url %>" /> or <liferay-captcha:captcha url="<%= url %>" />. Liferay Portal out-of-the-box behavior with no customizations is not vulnerable.

Remediation