-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability description points to a stored XSS issue in Liferay Portal's Forms, specifically within rich text fields. By analyzing the commits between the last vulnerable version (7.4.3.111-ga111) and the first patched version (7.4.3.112-ga112), I identified a security fix with the message 'LPD-15082 Escape rich text value after extracting the text'. This commit directly addresses the vulnerability. The change was made in the render method of the RichTextDDMFormFieldValueRenderer class. The patch introduces HtmlUtil.escape() to sanitize the output of the rich text field, preventing the execution of injected scripts. This confirms that the render method was the vulnerable function, as it was processing and displaying user-provided rich text content without proper output encoding.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| com.liferay.portal:release.portal.bom | maven | >= 7.3.2, < 7.4.3.112-ga112 | 7.4.3.112-ga112 |
Ongoing coverage of React2Shell