GitHub Advisoryadvisory · Maven

GHSA-hwp2-gvm5-452f Liferay Portal Allows Cross-Site Scripting (XSS) via the SimpleCaptcha API

MEDIUM Published 2022-05-24 Modified 2025-04-28 Official page ↗
Aliases
CVE-2019-6588
Ecosystem
Maven
Packages
com.liferay.portal:release.portal.bom
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2025-04-28

Affected packages

• Maven com.liferay.portal:release.portal.bom: < 7.1.0 → fixed in 7.1.0

Description

In Liferay Portal before 7.1 CE GA4, an XSS vulnerability exists in the SimpleCaptcha API when custom code passes unsanitized input into the "url" parameter of the JSP taglib call " /> or " />. Liferay Portal out-of-the-box behavior with no customizations is not vulnerable.

Related

Alias · CVE (1)

  • CVE-2019-6588 In Liferay Portal before 7.1 CE GA4, an XSS vulnerability exists in the SimpleCaptcha API when custom code passes unsanitized input into… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References