Skip to:

  1. Skip to Jira Navigation
  2. Skip to Side Navigation
  3. Skip to Main Content

LSV-855: Stored XSS with ERC in Commerce catalog

Affects versions

Fix versions

7.0 Fix Pack Version

None

7.1 Fix Pack Version

None

7.2 Fix Pack Version

None

7.3 Fix Pack Version

8

7.4 Fix Pack Version

None

CVE IDs

CVSS Base Score

CVSS Vector String

Labels

Description

Cross-site scripting (XSS) vulnerability in the Commerce module's edit catalog page in Liferay DXP 7.3 before update 8 allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_commerce_catalog_web_internal_portlet_CommerceCatalogsPortlet_externalReferenceCode parameter.

Activity

Show:
Fixed
Pinned fields
Click on the next to a field label to start pinning.

Details

Assignee

Reporter

Priority

Zendesk Support

Created September 22, 2022 at 3:29 AM
Updated October 18, 2022 at 7:07 PM
Resolved October 18, 2022 at 7:07 PM