-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
JavaJava| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| com.liferay.portal:release.portal.bom | maven | <= 7.4.2 | |
| com.liferay.portal:release.dxp.bom | maven | >= 7.3.0, < 7.3.10.u4 | 7.3.10.u4 |
| com.liferay.portal:release.dxp.bom | maven | >= 7.2.0, < 7.2.10.fp17 | 7.2.10.fp17 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from unsanitized user input in the 'name' field of geolocation custom fields. Two key points of failure exist: 1) The column update function ExpandoColumnLocalServiceImpl.updateColumn that stores the raw payload without validation, and 2) The rendering logic GeolocationFieldRenderer.render in JSP that displays the unescaped name value. Both align with Liferay's architecture patterns and the XSS attack vector described - storage of malicious input and subsequent unsafe output in presentation layer.
KEV Misses 88% of Exploited CVEs- Get the report