Description
In LifeRay Portal CE 7.1.0 through 7.2.1 GA2, the First Name, Middle Name, and Last Name fields for user accounts in MyAccountPortlet are all vulnerable to a persistent XSS issue. Any user can modify these fields with a particular XSS payload, and it will be stored in the database. The payload will then be rendered when a user utilizes the search feature to search for other users (i.e., if a user with modified fields occurs in the search results). This issue was fixed in Liferay Portal CE version 7.3.0 GA1.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Exploit-DB 1
- LifeRay 7.2.1 GA2 - Stored XSS EDB-49091 · webapps · Nov 23, 2020
GitHub 2 repositories
-
3ndG4me/liferay-xss-7.2.1GA2-poc-report-CVE-2020-7934 ★ 6 · Oct 17, 2019
Authenticated Stored XSS in LifeRay 7.2.0 GA1 via MyAccountPortlet executed by Search Results
-
giardinas-dev/audit-xss-cve-2020-7934 ★ 0 · Feb 4, 2022
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | com.liferay.portal:release.portal.bom | >= 7.1.0, < 7.3.0 | 7.3.0 | GHSA-f99h-h678-fgg4 |