-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe analysis of the provided commits clearly indicates that the vulnerability lies within the getFriendlyURL method of the DisplayPageLayoutTypeController class. The commit f2621572ca5abfe46bad0dca2fa4836deeefa000 shows the exact code change that mitigates the vulnerability: the addition of HtmlUtil.escape() to the returned friendlyURL. The commit 9bd2ae22416d20f5e8ce2800ea96993c7df98f95 adds a test case that explicitly demonstrates the XSS vulnerability by setting a malicious payload in the CURRENT_URL request attribute and asserting that the output of getFriendlyURL is properly escaped. This confirms that the getFriendlyURL function was the source of the vulnerability.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| com.liferay:com.liferay.layout.type.controller.display.page | maven | < 3.0.59 | 3.0.59 |