Uploaded image for project: 'PUBLIC - Liferay Portal Community Edition'
  1. PUBLIC - Liferay Portal Community Edition
  2. LPS-31823

XSS in Search portlet if results are displayed in document form

    Details

      Description

      • Add search portlet to a page
      • Configure the portlet to display results in Document form
      • Create a webcontent entry, Blog entry, Wiki page entry or Message board entry with some XSS in the title: "><script>alert('whatever content title');</script>
      • Search for the content you have created
      • Notice the alerts in search results

        Attachments

          Issue Links

            Activity

              People

              Assignee:
              luyang.tan Luyang Tan (Inactive)
              Reporter:
              laszlo.csontos Laszlo Csontos (Inactive)
              Participants of an Issue:
              Recent user:
              Esther Sanz
              Votes:
              0 Vote for this issue
              Watchers:
              1 Start watching this issue

                Dates

                Created:
                Updated:
                Resolved:
                Days since last comment:
                7 years, 44 weeks, 2 days ago

                  Packages

                  Version Package
                  6.1.2 CE GA3
                  6.1.30 EE GA3
                  6.2.0 CE M3