CVE-2019-6588
published 2019-06-03CVE-2019-6588: In Liferay Portal before 7.1 CE GA4, an XSS vulnerability exists in the SimpleCaptcha API when custom code passes unsanitized input into the "url" parameter of…
PriorityP431medium4.7CVSS 3.0
AVNACHPRNUIRSCCLILAN
EXPLOIT
EPSS
2.28%
81.3th percentile
In Liferay Portal before 7.1 CE GA4, an XSS vulnerability exists in the SimpleCaptcha API when custom code passes unsanitized input into the "url" parameter of the JSP taglib call " /> or " />. Liferay Portal out-of-the-box behavior with no customizations is not vulnerable.
Affected
18 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| liferay | liferay_portal | <= 6.0.6 | — |
| liferay | liferay_portal | — | — |
| liferay | liferay_portal | — | — |
| liferay | liferay_portal | — | — |
| liferay | liferay_portal | — | — |
| liferay | liferay_portal | — | — |
| liferay | liferay_portal | — | — |
| liferay | liferay_portal | — | — |
| liferay | liferay_portal | — | — |
| liferay | liferay_portal | — | — |
| liferay | liferay_portal | — | — |
| liferay | liferay_portal | — | — |
| liferay | liferay_portal | — | — |
| liferay | liferay_portal | — | — |
| liferay | liferay_portal | — | — |
| liferay | liferay_portal | — | — |
| liferay | liferay_portal | — | — |
| liferay | liferay_portal | — | — |
CVSS provenance
nvdv3.04.7MEDIUMCVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
nvdv2.02.6LOWAV:N/AC:H/Au:N/C:N/I:P/A:N
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Liferay Portal Allows Cross-Site Scripting (XSS) via the SimpleCaptcha API
ghsa·2022-05-24
CVE-2019-6588 [MEDIUM] CWE-79 Liferay Portal Allows Cross-Site Scripting (XSS) via the SimpleCaptcha API
Liferay Portal Allows Cross-Site Scripting (XSS) via the SimpleCaptcha API
In Liferay Portal before 7.1 CE GA4, an XSS vulnerability exists in the SimpleCaptcha API when custom code passes unsanitized input into the "url" parameter of the JSP taglib call " /> or " />. Liferay Portal out-of-the-box behavior with no customizations is not vulnerable.
OSV
Liferay Portal Allows Cross-Site Scripting (XSS) via the SimpleCaptcha API
osv·2022-05-24
CVE-2019-6588 [MEDIUM] Liferay Portal Allows Cross-Site Scripting (XSS) via the SimpleCaptcha API
Liferay Portal Allows Cross-Site Scripting (XSS) via the SimpleCaptcha API
In Liferay Portal before 7.1 CE GA4, an XSS vulnerability exists in the SimpleCaptcha API when custom code passes unsanitized input into the "url" parameter of the JSP taglib call " /> or " />. Liferay Portal out-of-the-box behavior with no customizations is not vulnerable.
No detection rules found.
No writeups or analysis indexed.
http://packetstormsecurity.com/files/153252/Liferay-Portal-7.1-CE-GA4-Cross-Site-Scripting.htmlhttps://dev.liferay.com/web/community-security-team/known-vulnerabilities/liferay-portal-71/-/asset_publisher/7v4O7y85hZMo/content/cst-7130-multiple-xss-vulnerabilities-in-7-1-ce-ga3http://packetstormsecurity.com/files/153252/Liferay-Portal-7.1-CE-GA4-Cross-Site-Scripting.htmlhttps://dev.liferay.com/web/community-security-team/known-vulnerabilities/liferay-portal-71/-/asset_publisher/7v4O7y85hZMo/content/cst-7130-multiple-xss-vulnerabilities-in-7-1-ce-ga3
2019-06-03
Published