Cross Site Scripting (XSS)

2019-03-2508:40:43

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

0.002 Low

EPSS

Percentile

59.3%

JSON

Liferay Portal is vulnerable for Cross site scripting (XSS). A remote attacker is able to inject arbitrary Javascript into a victim’s browser via the p_p_id parameter in the Plugins Confguration section of Control Panel.

CPENameOperatorVersion
liferay portal impleq5.2.3
liferay portal serviceeq5.2.3

CPE	Name	Operator	Version
	liferay portal impl	eq	5.2.3
	liferay portal service	eq	5.2.3

References

issues.liferay.com/browse/LPS-6034

www.kb.cert.org/vuls/id/750796