Listen to this Post
How the mentioned CVE works:
This Cross-Site Scripting (XSS) vulnerability exists within the Calendar widget of Liferay Portal and Liferay DXP. The application fails to properly sanitize user-supplied input in the Calendar’s “Name” text field. A remote attacker can exploit this by crafting a malicious payload containing arbitrary web script or HTML. When this specially crafted “Name” is saved and subsequently rendered by the portal, the embedded script executes in the victim’s browser context. This occurs without proper validation or output encoding, allowing the attacker to perform actions within the security context of the authenticated user.
Platform: Liferay Portal/DXP
Version: 7.4.3.35-110
Vulnerability: Stored XSS
Severity: Moderate
date: 2024-09-29
Prediction: 2024-10-20
What Undercode Say:
`curl -s “http://target/group/guest/~/control_panel/manage?p_p_id=com_liferay_calendar_web_portlet_CalendarPortlet”`
``
`
`
How Exploit:
Craft malicious script payload. Inject into Calendar ‘Name’ field. Victim views calendar event. Script executes automatically.
Protection from this CVE:
Apply vendor patch. Implement input sanitization. Enforce output encoding.
Impact:
Session hijacking. Unauthorized actions. Defacement.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
