LSV-954: Stored XSS with search results if highlighting is disabled

• Type: Bug
• Status: Closed
• Priority: Minor
• Resolution: Fixed
• Affects Version/s: 7.1 DXP (7.1.10)
• Fix Version/s: 7.1.x EE
• Component/s: None
• Labels:
  • liferay-fixpack-dxp-17-7210
  • liferay-fixpack-dxp-27-7110
  • liferay-fixpack-dxp-4-7310
• CVSS Base Score: 5.4
• CVSS Vector String: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
• 7.1 Fix Pack Version: 27

Cross-site scripting (XSS) vulnerability in the Portal Search module's Search Result app in Liferay DXP allows remote attackers to inject arbitrary web script or HTML into the Search Result app's search result by adding any searchable content (e.g., blog, message board message, web content article) to the application.