-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| com.liferay.portal:release.portal.bom | maven | <= 7.4.2 | |
| com.liferay.portal:release.dxp.bom | maven | >= 7.3.0, < 7.3.10.u4 | 7.3.10.u4 |
| com.liferay.portal:release.dxp.bom | maven | >= 7.2.0, < 7.2.10.fp17 | 7.2.10.fp17 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from unsanitized filename rendering in the Message Board attachment interface. While exact code isn't available, Liferay's architecture typically handles attachments through JSP views. The description explicitly cites filename-based XSS, indicating the rendering path fails to use proper escaping mechanisms like HtmlUtil.escape() when outputting filenames. This matches common XSS patterns in Java web applications where user-controlled input is directly embedded in responses.