XSS Vulnerability in Liferay Portal SimpleCaptcha API

CVE-2019-6588 · LOW Severity

AV:N/AC:H/AU:N/C:N/I:P/A:N

In Liferay Portal before 7.1 CE GA4, an XSS vulnerability exists in the SimpleCaptcha API when custom code passes unsanitized input into the "url" parameter of the JSP taglib call <liferay-ui:captcha url="<%= url %>" /> or <liferay-captcha:captcha url="<%= url %>" />. Liferay Portal out-of-the-box behavior with no customizations is not vulnerable.

Learn more about our Api Penetration Testing.