Uploaded image for project: 'PUBLIC - Liferay Portal Community Edition'
  1. PUBLIC - Liferay Portal Community Edition
  2. LPS-16963

XSS issue in "Return to Full Page" link

    Details

    • Branch Version/s:
      6.0.x, 5.2.x
    • Backported to Branch:
      Committed

      Description

      1) Manage Pages
      2) Modify the current URL by changing the value of the "_88_redirect" or "_88_backURL" parameter to alert(1234)
      3) Reload the page using the modified URL
      4) Click "Return to Full Page"

      A JavaScript alert window will appear

        Attachments

          Issue Links

            Activity

              People

              Assignee:
              sophia.zhang Sophia Zhang
              Reporter:
              samuel.kong Samuel Kong
              Participants of an Issue:
              Recent user:
              Esther Sanz
              Votes:
              0 Vote for this issue
              Watchers:
              0 Start watching this issue

                Dates

                Created:
                Updated:
                Resolved:
                Days since last comment:
                9 years, 30 weeks, 5 days ago

                  Packages

                  Version Package
                  5.2.X EE
                  6.0.12 EE
                  6.1.0 CE RC1