| Package | Affected versions | Patched versions |
|---|---|---|
| com.liferay.portal:release.portal.bom | < 7.1.0 | 7.1.0 |
| liferay portal | = 6.1.0= 6.1.1= 6.1.2= 6.2.0= 6.2.1= 6.2.2= 6.2.3= 6.2.4= 6.2.5= 7.0.0= 7.0.1= 7.0.2= 7.0.3= 7.0.4= 7.0.5= 7.0.6= 7.1.0≤ 6.0.6 |
In Liferay Portal before 7.1 CE GA4, an XSS vulnerability exists in the SimpleCaptcha API when custom code passes unsanitized input into the "url" parameter of the JSP taglib call <liferay-ui:captcha url="<%= url %>" /> or <liferay-captcha:captcha url="<%= url %>" />. Liferay Portal out-of-the-box behavior with no customizations is not vulnerable.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free