[LPE-16387] Reflected XSS in JSONWS API documentation page - Liferay Issues

XML

Word

Printable

Details

Type: Bug
Status: Closed
Priority: Minor
Resolution: Completed
Affects Version/s: 6.2 EE GA1 (6.2.10), 7.0 DE (7.0.10)
Fix Version/s: 6.2.X EE, 7.0.X EE
Component/s: Core Infrastructure > JSON WS Tracker, Security Vulnerability
Labels:

Fix Pack Status:
Scheduled
Business Value:
3
7.0 Fix Pack Version:
44

Description

A reflected cross-site scripting (XSS) vulnerability exist on the JSONWS API documentation page. An attacker can potentially exploit this security vulnerability to insert malicious JavaScript into a page.

Attachments

Activity

People

Assignee:: Joshua Cords

Reporter:: Tibor Lipusz

Votes:: 0 Vote for this issue

Watchers:: 0 Start watching this issue

Dates

Created:: 12/Mar/18 3:09 AM

Updated:: 10/May/19 2:02 AM

Resolved:: 10/Sep/18 8:48 AM

Packages

Version	Package
6.2.X EE
7.0.X EE