PT-2019-18170 · Liferay · Liferay Portal

Published 2019-06-03 · Updated 2022-05-24 · CVE-2019-6588

Positive Technologies (AI Summary)

CVSS v3.1

4.7

Medium

Base vector

AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Liferay Portal versions prior to 7.1 CE GA4

Description A security issue exists in the SimpleCaptcha API when custom code passes unsanitized input into the url parameter of the JSP taglib call, such as <liferay-ui:captcha url="<%= url %>" /> or <liferay-captcha:captcha url="<%= url %>" />. This issue does not affect Liferay Portal's out-of-the-box behavior without customizations.

Recommendations For versions prior to 7.1 CE GA4, ensure that any custom code using the SimpleCaptcha API sanitizes input passed to the url parameter to prevent exploitation. As a temporary workaround, consider validating and sanitizing all user-input data used in the url parameter of the affected JSP taglib calls until a patch is available.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2019-6588

GHSA-HWP2-GVM5-452F

Affected Products

Liferay Portal

References · 7

• 🔥 https://exploit-db.com/exploits/46983 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-6588 · Security Note
• https://osv.dev/vulnerability/CVE-2019-6588 · Vendor Advisory
• https://dev.liferay.com/web/community-security-team/known-vulnerabilities/liferay-portal-71/-/asset_publisher/7v4O7y85hZMo/content/cst-7130-multiple-xss-vulnerabilities-in-7-1-ce-ga3 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-hwp2-gvm5-452f · Vendor Advisory
• https://github.com/liferay/liferay-portal · Note
• http://packetstormsecurity.com/files/153252/Liferay-Portal-7.1-CE-GA4-Cross-Site-Scripting.html · Note