Uploaded image for project: 'PUBLIC - Liferay Portal Community Edition'
  1. PUBLIC - Liferay Portal Community Edition
  2. LPS-31823

XSS in Search portlet if results are displayed in document form

Details

    Description

      • Add search portlet to a page
      • Configure the portlet to display results in Document form
      • Create a webcontent entry, Blog entry, Wiki page entry or Message board entry with some XSS in the title: "><script>alert('whatever content title');</script>
      • Search for the content you have created
      • Notice the alerts in search results

      Attachments

        Issue Links

          Activity

            People

              luyang.tan Luyang Tan (Inactive)
              laszlo.csontos Laszlo Csontos (Inactive)
              Kiyoshi Lee Kiyoshi Lee
              Votes:
              0 Vote for this issue
              Watchers:
              1 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved:
                9 years, 50 weeks, 3 days ago

                Packages

                  Version Package
                  6.1.2 CE GA3
                  6.1.30 EE GA3
                  6.2.0 CE M3