Uploaded image for project: 'PUBLIC - Liferay Portal Community Edition'
  1. PUBLIC - Liferay Portal Community Edition
  2. LPS-42754

Navigate to control panel will throw XSS window after leaving the site with JS name.

    Details

      Description

      1. Create a Site named <script>alert("123");</script> .
      2. Give a page to the site.
      3. View the page -> Admin -> control panel.

      Expected result:
      There should be no JS alert shows up.

      Actual result:
      It will alert JS window.


      CVSS Base Score: 7.1
      CVSS Temporal Score: 5.6
      CVSS Vector: (AV:N/AC:H/Au:S/C:C/I:C/A:C/E:P/RL:OF/RC:C)
      

        Attachments

          Issue Links

            Activity

              People

              Assignee:
              he.song Serena Song (Inactive)
              Reporter:
              he.song Serena Song (Inactive)
              Participants of an Issue:
              Recent user:
              Esther Sanz
              Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

                Dates

                Created:
                Updated:
                Resolved:
                Days since last comment:
                7 years, 45 weeks, 4 days ago

                  Packages

                  Version Package
                  6.2.3 CE GA4
                  6.2.X EE
                  7.0.0 M1