Uploaded image for project: 'PUBLIC - Liferay Portal Enterprise Edition'
  1. PUBLIC - Liferay Portal Enterprise Edition
  2. LPE-16948

Stored XSS with user name in search result (LPE-16911 was incomplete)

Details

    • 5.4
    • CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
    • 17
    • 4

    Description

      In Liferay DXP 7.2 and DXP 7.1, a stored cross-site scripting (XSS) vulnerability exist with user's name in Search Bar search results.

      Attachments

        Issue Links

          Activity

            People

              support-ee EE Support
              EnterpriseReleaseHU Enterprise Release HU
              Votes:
              0 Vote for this issue
              Watchers:
              1 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved:

                Packages

                  Version Package
                  7.1.x EE
                  7.2.X EE