| Package | Affected versions | Patched versions |
|---|---|---|
| com.liferay.portal:release.dxp.bom | ≥ 7.3.0, < 7.3.10.fp3 | 7.3.10.fp3 |
| com.liferay:com.liferay.dynamic.data.mapping.form.field.type | < 6.0.11 | 6.0.11 |
| liferay portal | = 7.4.0≥ 7.3.5, < 7.3.7 | 7.3.7 |
Multiple cross-site scripting (XSS) vulnerabilities in Dynamic Data Mapping Form Field Type before 6.0.11 from Liferay Portal 7.3.5 through 7.4.0, and Liferay DXP 7.3 before service pack 3 allow remote attackers to inject arbitrary web script or HTML via a form field's help text to (1) Forms module's form builder, or (2) App Builder module's object form view's form builder.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free