Vulners
Lucene search
Liferay Portal 6.2 EE SP8 Cross Site Scripting Vulnerability
| Reporter | Title | Published | Views | Family All 6 |
|---|---|---|---|---|
 | CVE-2014-8349 | 24 Nov 201416:00 | – | cve |
 | CVE-2014-8349 | 24 Nov 201416:00 | – | cvelist |
 | EUVD-2014-8187 | 7 Oct 202500:30 | – | euvd |
 | CVE-2014-8349 | 24 Nov 201416:59 | – | nvd |
 | Cross site scripting | 24 Nov 201416:59 | – | prion |
 | Cross-site Scripting (XSS) | 2 Jun 202006:04 | – | veracode |
- Vendor Status: CONFIRMED
- Vendor Disclosure Date: October 17th 2014
- Public Disclosure Date: November 14th 2014
- Affected Vendor: LIFERAY - http://www.liferay.com/
- Affected System: Liferay Portal 6.2 EE SP8 and older versions
- Vulnerability Status: Fixed
Associated CWE:
CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') - http://cwe.mitre.org/data/definitions/79.html
******************************************************************************
CVE-2014-8349:
Cross-site scripting (XSS) vulnerability in Liferay Portal Enterprise Edition (EE) allows remote authenticated users to inject arbitrary web script or HTML via the "_20_body" parameter in the comment field of an uploaded file.
The Javascript injection will later exploit when clicking on "View" from under the "My Workflow Tasks" option within the "My Account" menu, when logged in with an administrator account, and looking for the approval of comments.
- Available fix:
Patch: LPE-12961
# 0day.today [2018-01-09] #Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
21 Nov 2014 00:00Current
6.1Medium risk
Vulners AI Score6.1
EPSS0.01514