-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability lies in the EditKBArticle.js file, where the EditKBArticle function handles the rendering of attachment filenames on the Knowledge Base article edit page. The provided patch 46dd9b77cc2514761828d9b483a1dfe5d6e6b76d clearly shows that the value of an input field, which is derived from an attachment's filename (filesChecked[i].value), was not being escaped before being rendered into the HTML. The fix involves wrapping this value with an escapeHTML function. This indicates that prior to the patch, a malicious filename containing HTML and script could be injected, leading to a cross-site scripting (XSS) vulnerability. The EditKBArticle function is the direct point where this unescaped data is processed and rendered, making it the vulnerable function that would appear in a runtime profile during exploitation.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| com.liferay:com.liferay.knowledge.base.web | maven | < 5.0.109 | 5.0.109 |