Stored XSS with Template name

• Type: Bug
• Status: Closed
• Priority: Minor
• Resolution: Fixed
• Affects Version/s: 7.0 DE (7.0.10), 7.1 DXP (7.1.10), 7.2 DXP (7.2.10)
• Fix Version/s: 7.0.X EE, 7.1.x EE, 7.2.X EE
• Component/s: Security Vulnerability, WCM > Publication > Web Content Display
• Labels:
  • liferay-dxp-70-sp15
  • liferay-dxp-72-sp3
  • liferay-fixpack-de-94-7010
  • liferay-fixpack-dxp-19-7110
  • liferay-fixpack-dxp-8-7210
  • lsv
  • lsv-730
  • sev-3
• CVSS Base Score: 5.4
• CVSS Vector String: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
• 7.0 Fix Pack Version: 94
• 7.1 Fix Pack Version: 19
• 7.2 Fix Pack Version: 8

Cross-site scripting (XSS) vulnerability in the Web Content Display in Liferay DXP 7.0, 7.1 and 7.2 allows remote attackers to inject arbitrary web script or HTML via web content template names.