-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
JavaJavaMiggo AIRoot Cause AnalysisThe vulnerability stems from unsanitized reflection of user input from the 'Blocked Email Domains' field. Liferay's architecture typically processes settings through MVC portlet actions (like InstanceSettingsAction) and renders them in JSPs. The combination of: 1) A controller action that stores raw input, and 2) A view layer (JSP) that displays this input without proper escaping aligns with the described XSS pattern. The confidence is high because this matches Liferay's standard implementation patterns for settings management and the CWE-79 XSS vector description.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| com.liferay.portal:release.portal.bom | maven | >= 7.4.3.44, <= 7.4.3.97 | 7.4.3.98 |
| com.liferay.portal:release.dxp.bom | maven | >= 2023.Q3, < 2023.Q3.6 | 2023.Q3.6 |
| com.liferay.portal:release.dxp.bom |
| maven |
| >= 7.4.13.u44, <= 7.4.13.u92 |
Ongoing coverage of React2Shell