CVE-2022-42110 An XSS vulnerability in Liferay Portal and Liferay DXP allows remote attackers to inject arbitrary web script.

CVE-2022-42110 An XSS vulnerability in Liferay Portal and Liferay DXP allows remote attackers to inject arbitrary web script.

When creating a new Announcement, the application does not properly sanitize user-supplied input, resulting in XSS. When editing an existing Announcement, the application does not properly sanitize user-supplied input, resulting in XSS. When viewing the source of an existing Announcement, the application does not properly sanitize user-supplied input, resulting in XSS. When creating a new event, the application does not properly sanitize user-supplied input, resulting in XSS. When editing an existing event, the application does not properly sanitize user-supplied input, resulting in XSS. When viewing the source of an existing event, the application does not properly sanitize user-supplied input, resulting in XSS. Liferay 7.1.0 through 7.4.2 and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 17, and 7.3 before service pack 3 do not properly sanitize user-supplied input, resulting in XSS. Credit: This issue was discovered by Lorenzo Mazza of the Cisco Talos security research team.

Liferay and Apache Struts 2

CVE-2018-11776: Liferay and Apache Struts2 Hacking Campaign
Liferay is an open source e-commerce solution that is used by many organizations of all sizes. It provides a highly customizable platform for managing every aspect of the business. Additionally, it features robust security features to protect against malicious threats that target the system.

CVE-2023-42058

Persistent Cross-Site Scripting
When creating a new Announcement, the application does not properly sanitize user-supplied input, resulting in XSS. When editing an existing Announcement, the application does not properly sanitize user-supplied input, resulting in XSS. When viewing the source of an existing Announcement, the application does not properly sanitize user-supplied input, resulting in XSS. When creating a new event, the application does not properly sanitize user-supplied input, resulting in XSS. When editing an existing event, the application does not properly sanitize user-supplied input, resulting in XSS. When viewing the source of an existing event, the application does not properly sanitize user-supplied input, resulting in XSS. Liferay 7.1 through 7.4 and Liferay DXP 7.1 before fix pack 27 do not properly sanitize user-supplied input when adding or updating comments on posts and pages with certain tags (defined by functionalities), which causes users to be logged out while they are still logged into Liferay and results in persistent cross-site scripting (XSS). Credit: This issue was discovered by Lorenzo Mazza of the Cisco Talos security research team.

CVE-2023-4120

When creating a new Announcement, the application does not properly sanitize user-supplied input, resulting in XSS. When editing an existing Announcement, the application does not properly sanitize user-supplied input, resulting in XSS. When viewing the source of an existing Announcement, the application does not properly sanitize user-supplied input, resulting in XSS. When creating a new event, the application does not properly sanitize user-supplied input, resulting in XSS. When editing an existing event, the application does not properly sanitize user-supplied input, resulting in XSS. When viewing the source of an existing event, the application does not properly sanitize user-supplied input, resulting in XSS. Liferay 7 through 7.2 and 7.3 before service pack 3 do not properly sanitize user-supplied input when processing a request for a generic resource that is retrieved from LDAP or DB2 using either LDAPv3 or JDBC respectively , resulting in XXE vulnerability. This issue was discovered by Lorenzo Mazza of Cisco Talos security research team Credit: This issue was discovered by Lorenzo Mazza of Cisco Talos security research team

Lorenzo Mazza of Cisco Talos

References

Subscribe to CVE.news
Don’t miss out on the latest issues. Sign up now to get access to the library of members-only issues.
jamie@example.com
Subscribe