Liferay Portal
Approved changes feed: RSS · Atom
cpe:2.3:a:liferay:liferay_portal:7.1.3:*:*:*:*:*:*:*
part: a version: 7.1.3 update: *
| Vendor | Liferay (5231553d-d54f-5cd9-bf56-0bf2ac7f0033) |
|---|---|
| Product | Liferay Portal (e3d198b8-0678-58dd-bf73-106b66a02cfe) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2020-25476 |
vulnerable | 2026-06-08 05:22:36.757817 |
Details available
Liferay CMS Portal version 7.1.3 and 7.2.1 have a blind persistent cross-site scripting (XSS) vulnerability in the user name parameter to Calendar. An attacker can insert the malicious payload on the username, lastname or surname fields of its own profile, and the malicious payload will be injected and reflected in the calendar of the user who submitted the payload. An attacker could escalate its privileges in case an admin visits the calendar that injected the payload.
Published: 2021-01-07T16:04:39.000Z
Updated: 2024-08-04T15:33:05.672Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.