-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| com.liferay.commerce:com.liferay.commerce.order.web | maven | >= 5.0.29, < 5.0.101 | 5.0.101 |
JavaJavaMiggo AIRoot Cause AnalysisThe vulnerability is a classic stored Cross-Site Scripting (XSS) issue within the Liferay Portal Commerce module. The root cause is the failure to properly sanitize user-provided input before rendering it on a web page. The provided commit e6d49eda196676aa3fecb26f6a8ba100602d0c36 serves as the primary evidence for this analysis.
The patch modifies the general.jsp file, which is used to display order information. Specifically, it changes how the account name is displayed. Before the patch, the account name was rendered directly into the HTML using <%= accountEntry.getName() %>. This means that if an account name contained HTML or JavaScript, it would be interpreted by the browser.
The fix wraps the output of accountEntry.getName() with HtmlUtil.escape(), a function that neutralizes potentially malicious characters (like <, >, ") by converting them into their corresponding HTML entities. This prevents the browser from interpreting them as code.
During exploitation, a profiler would trace the execution flow to the rendering of the general.jsp page. JSP files are compiled into Java Servlets, and the main logic resides within the _jspService method. Therefore, org.apache.jsp.commerce_order.general_jsp._jspService is the precise function that would appear in a runtime profile and is the location of the vulnerable code. The call to accountEntry.getName() would also be observed as the source of the tainted data that triggers the vulnerability.
org.apache.jsp.commerce_order.general_jsp._jspServicemodules/apps/commerce/commerce-order-web/src/main/resources/META-INF/resources/commerce_order/general.jsp
Ongoing coverage of React2Shell