-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| com.liferay.portal:release.portal.bom | maven | >= 7.1.0, < 7.4.3.39 | 7.4.3.39 |
| com.liferay.portal:release.dxp.bom | maven | >= 7.1, < 7.4.13.u39 | 7.4.13.u39 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from improper neutralization of the 'Dispatch name' parameter. In Liferay's architecture, portlet dispatching mechanisms (like DispatchPortlet) handle action routing. The processDispatch method would be a logical point where the dispatch name parameter is retrieved from the request and used to generate responses. Without proper context-aware escaping (e.g., HTML entity encoding), this creates an XSS vector. The confidence is medium because while the exact code isn't visible, this pattern matches Liferay's architecture and standard XSS vulnerability patterns in Java web applications.
JavaJavaOngoing coverage of React2Shell