Cross-Site Scripting (XSS)

2020-06-0204:55:02

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

0.001 Low

EPSS

Percentile

33.7%

JSON

com.liferay.frontend.js.spa.web is vulnerable to cross-site scripting. A remote attacker is able to inject and execute arbitrary Javascript in a user’s browser via the Liferay.SPA.loginRedirect parameter.

CPENameOperatorVersion
com.liferay.frontend.js.spa.weble1.0.13
com.liferay.frontend.js.spa.weble1.0.13

CPE	Name	Operator	Version
	com.liferay.frontend.js.spa.web	le	1.0.13
	com.liferay.frontend.js.spa.web	le	1.0.13

References

dev.liferay.com/web/community-security-team/known-vulnerabilities/liferay-portal-70/-/asset_publisher/cjE0ourZXJZE/content/cst-7017-multiple-xss-vulnerabilities

github.com/liferay/liferay-portal/commit/333f65bae9106182d12e02d249d4f95e16e93fa2

jvndb.jvn.jp/ja/contents/2016/JVNDB-2016-008756.html

portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/113764592