// For flags

CVE-2020-7934

LifeRay 7.2.1 GA2 - Stored XSS

Severity Score

5.4
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

2
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

In LifeRay Portal CE 7.1.0 through 7.2.1 GA2, the First Name, Middle Name, and Last Name fields for user accounts in MyAccountPortlet are all vulnerable to a persistent XSS issue. Any user can modify these fields with a particular XSS payload, and it will be stored in the database. The payload will then be rendered when a user utilizes the search feature to search for other users (i.e., if a user with modified fields occurs in the search results). This issue was fixed in Liferay Portal CE version 7.3.0 GA1.

En LifeRay Portal CE versiones 7.1.0 hasta 7.2.1 GA2, los campos First Name, Middle Name, y Last Name para las cuentas de usuario en MyAccountPortlet son vulnerables a un problema de tipo XSS persistente. Cualquier usuario puede modificar estos campos con una carga útil XSS particular, y será almacenada en la base de datos. La carga útil entonces será renderizada cuando un usuario utilice la funcionalidad search para buscar a otros usuarios (es decir, si se presenta un usuario con campos modificados en los resultados de la búsqueda). Este problema fue corregido en el Portal Liferay CE versión 7.3.0 GA1

LifeRay version 7.2.1 GA2 suffers from a persistent cross site scripting vulnerability.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
Required
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
None
Attack Vector
Network
Attack Complexity
Medium
Authentication
Single
Confidentiality
None
Integrity
Partial
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2020-01-23 CVE Reserved
  • 2020-01-28 CVE Published
  • 2020-11-23 First Exploit
  • 2023-03-07 EPSS Updated
  • 2024-08-04 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
CWE
  • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Liferay
Search vendor "Liferay"
Liferay Portal
Search vendor "Liferay" for product "Liferay Portal"
>= 7.1.0 <= 7.2.1
Search vendor "Liferay" for product "Liferay Portal" and version " >= 7.1.0 <= 7.2.1"
community
Affected