Server side cross-site scripting In com.liferay.portal:release.dxp.bom
Description
Liferay Portal and Liferay DXP allows arbitrary injection via form field Multiple cross-site scripting (XSS) vulnerabilities in Dynamic Data Mapping Form Field Type before 6.0.11 from Liferay Portal 7.3.5 through 7.4.0, and Liferay DXP 7.3 before service pack 3 allow remote attackers to inject arbitrary web script or HTML via a form field's help text to (1) Forms module's form builder, or (2) App Builder module's object form view's form builder.
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Package | Affected version | Patched versions |
|---|---|---|---|
 maven | 7.3.10.fp3 | ||
maven | 6.0.11 |
Aliases
1. 2. 3. 4.
References
1. 2. 3.