-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| com.liferay.portal:release.portal.bom | maven | < 7.4.3.12 | 7.4.3.12 |
| com.liferay.portal:release.dxp.bom | maven | >= 7.4.0, < 7.4.3.13u8 | 7.4.3.13u8 |
| com.liferay.portal:release.dxp.bom | maven | >= 7.3.0, < 7.3.10.u4 | 7.3.10.u4 |
| com.liferay.portal:release.dxp.bom | maven | < 7.2.10.fp17 | 7.2.10.fp17 |
JavaJavaMiggo AIRoot Cause AnalysisThe vulnerability manifests when search result highlighting is disabled, suggesting the XSS protection (normally provided by highlighting sanitization) is missing in this code path. While no specific code was provided, Liferay's architecture indicates search result rendering occurs in JSPs handling the Search Results portlet. The medium confidence reflects the lack of direct code evidence, but aligns with: 1) The attack vector requiring disabled highlighting 2) Liferay's known use of JSPs for portlet rendering 3) Common XSS patterns where conditional sanitization (enabled only for highlighted paths) creates vulnerabilities.
Ongoing coverage of React2Shell