Cross-Site Scripting (XSS)

2021-01-0805:20:22

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

0.001 Low

EPSS

Percentile

33.7%

JSON

com.liferay.calendar.web is vulnerable to cross-site scripting (XSS). An attacker is able to inject and execute arbitrary Javascript code in a user’s browser via the username, lastname and surname fields from profile page.

CPENameOperatorVersion
com.liferay.calendar.weble3.0.17
com.liferay.calendar.weble1.0.82
com.liferay.calendar.weble2.0.38

Name	Operator	Version
com.liferay.calendar.web	le	3.0.17
com.liferay.calendar.web	le	1.0.82
com.liferay.calendar.web	le	2.0.38

References

github.com/community-security-team/liferay-portal/compare/7.1.3-ga4...7.1.3-cumulative.patch

github.com/community-security-team/liferay-portal/compare/7.2.1-ga2...7.2.1-cumulative.patch

portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/119318646

0.001 Low

EPSS

Percentile

33.7%

JSON

Related for VERACODE:28930