-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe analysis of the provided commits clearly indicates that the getContent method within the com.liferay.portal.servlet.GoogleGadgetServlet class is the source of the reflected XSS vulnerability. The patches applied in commits 66c51e026f7c9eee8f82137a586ceea5bdc081a5 and f041e7058929618bb101b8e4bae5a8a226e6f8b8 directly address this by adding proper escaping to user-controlled input. Specifically, the title and widgetURL parameters were being appended to the response without being sanitized. The fix involves using HtmlUtil.escapeAttribute to ensure that any special characters in these parameters are properly escaped, preventing the injection and execution of malicious scripts. The vulnerability exists because the application trusts and directly uses user-provided data in a sensitive context. Therefore, any runtime profile during exploitation would show the com.liferay.portal.servlet.GoogleGadgetServlet.getContent function as the entry point for the malicious input.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| com.liferay.portal:com.liferay.portal.impl | maven | <= 114.1.0 |
A Semantic Attack on Google Gemini - Read the Latest Research