Description
Certain Liferay products are vulnerable to Cross Site Scripting (XSS) via the Commerce module. This affects Liferay Portal 7.3.5 through 7.4.2 and Liferay DXP 7.3 before update 8.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | com.liferay.commerce:com.liferay.commerce.catalog.web | < 4.0.8 | 4.0.8 | GHSA-wjfm-qxg2-q679 |
| Maven | com.liferay.portal:release.dxp.bom | >= 7.3.0, < 7.3.10.u8 | 7.3.10.u8 | GHSA-wjfm-qxg2-q679 |