PT-2021-11143 · Liferay · Liferay Cms Portal

Published 2021-01-07 · Updated 2022-05-24 · CVE-2020-25476

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: Liferay CMS Portal versions 7.1.3 through 7.2.1

Description: The issue is a blind persistent cross-site scripting (XSS) vulnerability in the user name parameter to Calendar. An attacker can insert a malicious payload on the username, lastname, or surname fields of their own profile, and the malicious payload will be injected and reflected in the calendar of the user who submitted the payload. This could allow an attacker to escalate their privileges if an admin visits the calendar that injected the payload.

Recommendations: For Liferay CMS Portal version 7.1.3, update to a version that fixes the blind persistent XSS vulnerability. For Liferay CMS Portal version 7.2.1, update to a version that fixes the blind persistent XSS vulnerability. As a temporary workaround, consider restricting access to the Calendar feature to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2020-25476

GHSA-PVPG-9553-F979

Affected Products

Liferay Cms Portal

References · 8

• https://github.com/community-security-team/liferay-portal/compare/7.1.3-ga4...7.1.3-cumulative.patch · Patch
• https://github.com/community-security-team/liferay-portal/compare/7.2.1-ga2...7.2.1-cumulative.patch · Patch
• https://osv.dev/vulnerability/GHSA-pvpg-9553-f979 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-25476 · Security Note
• https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/119318646 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-25476 · Vendor Advisory
• https://github.com/liferay/liferay-portal · Note
• https://t.me/cibsecurity/21772 · Telegram Post