Skip to:

  1. Skip to Jira Navigation
  2. Skip to Side Navigation
  3. Skip to Main Content

LSV-1034: SQL injection vulnerability during fragment upgrade

Affects versions

None

Fix versions

None

7.0 Fix Pack Version

7.1 Fix Pack Version

7.2 Fix Pack Version

7.3 Fix Pack Version

7.4 Fix Pack Version

CVE IDs

CVSS Base Score

CVSS Vector String

Labels

Description

SQL injection vulnerability in the Fragment module's PortletPreferences upgrade process in Liferay DXP 7.3 before update 4, and 7.4 before update 17 allows attackers to execute arbitrary SQL commands via a PortletPreferences' `namespace` attribute.

Activity

Show:
Fixed
Pinned fields
Click on the next to a field label to start pinning.

Details

Assignee

Reporter

Priority

Zendesk Support

Created March 9, 2022 at 9:00 AM
Updated October 18, 2022 at 7:44 PM
Resolved October 18, 2022 at 7:44 PM