CST-7227 Reflected XSS with 'backURL' in Users and Organizations

Description

In Liferay Portal 7.2.0 and 7.2.1, a reflected cross-site scripting (XSS) vulnerability exists with the 'portletURL' parameter in Users and Organizations (Control Panel).

Severity

Severity 2

Fixed Version(s)

May 2021 source patch for Liferay Portal 7.2.1. Details for working with source patches can be found on the Patching Liferay Portal page.

Publication date: Mon, 10 May 2021 16:00:00 +0000

Security advisories for Liferay's enterprise offerings (e.g., Liferay DXP) are only listed here since 2023. Historial advisories are availabe in the Help Center.

Known Vulnerabilities

Releases

Description

Severity

Fixed Version(s)