LSV-1097: Version disclosed in URL parameter

• Type: Bug
• Status: Closed
• Priority: Minor
• Resolution: Fixed
• Affects Version/s: 7.1 DXP (7.1.10)
• Fix Version/s: 7.1.x EE
• Component/s: None
• Labels:
  • liferay-fixpack-dxp-18-7210
  • liferay-fixpack-dxp-27-7110
• CVSS Base Score: 5.3
• CVSS Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
• 7.1 Fix Pack Version: 27
• 7.2 Fix Pack Version: 18

In Liferay DXP, some CSS and JavaScript files include the version number in the URL, which allows remote attackers to easily identify the version of the application that is running and the vulnerabilities that affect that version via 'b` parameter.