EUVD-2021-2502

Malware in sbrugna...

Liferay Portal 7.4.3.61 <= 7.4.3.131 XSS

The fragment preview functionality in Liferay Portal and Liferay DXP was found to be vulnerable to postMessage-based XSS because it allows a remote non-authenticated attacker to inject JavaScript into the fragment portlet URL. Note that Nessus has not tested for this issue but has instead relied...