From 3eb1ff5a130b49b6466cd82fd06a53718e60956d Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Wed, 28 May 2025 20:14:17 +0000 Subject: [PATCH] Publish Advisories GHSA-474f-cmx5-gm69 GHSA-4fx8-82f3-xcpc GHSA-jvvx-8g42-9559 GHSA-4fx8-82f3-xcpc GHSA-jvvx-8g42-9559 --- .../GHSA-474f-cmx5-gm69.json | 9 +- .../GHSA-4fx8-82f3-xcpc.json | 110 +++++++++++++++ .../GHSA-jvvx-8g42-9559.json | 129 ++++++++++++++++++ .../GHSA-4fx8-82f3-xcpc.json | 35 ----- .../GHSA-jvvx-8g42-9559.json | 35 ----- 5 files changed, 245 insertions(+), 73 deletions(-) create mode 100644 advisories/github-reviewed/2022/05/GHSA-4fx8-82f3-xcpc/GHSA-4fx8-82f3-xcpc.json create mode 100644 advisories/github-reviewed/2022/05/GHSA-jvvx-8g42-9559/GHSA-jvvx-8g42-9559.json delete mode 100644 advisories/unreviewed/2022/05/GHSA-4fx8-82f3-xcpc/GHSA-4fx8-82f3-xcpc.json delete mode 100644 advisories/unreviewed/2022/05/GHSA-jvvx-8g42-9559/GHSA-jvvx-8g42-9559.json diff --git a/advisories/github-reviewed/2022/05/GHSA-474f-cmx5-gm69/GHSA-474f-cmx5-gm69.json b/advisories/github-reviewed/2022/05/GHSA-474f-cmx5-gm69/GHSA-474f-cmx5-gm69.json index bff1d490848..2ae0d47984d 100644 --- a/advisories/github-reviewed/2022/05/GHSA-474f-cmx5-gm69/GHSA-474f-cmx5-gm69.json +++ b/advisories/github-reviewed/2022/05/GHSA-474f-cmx5-gm69/GHSA-474f-cmx5-gm69.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-474f-cmx5-gm69", - "modified": "2025-05-28T20:08:55Z", + "modified": "2025-05-28T20:12:08Z", "published": "2022-05-24T19:09:46Z", "aliases": [ "CVE-2021-33324" @@ -28,11 +28,14 @@ "introduced": "7.1.0" }, { - "last_affected": "7.3.1" + "fixed": "7.3.2" } ] } - ] + ], + "database_specific": { + "last_known_affected_version_range": "<= 7.3.1" + } }, { "package": { diff --git a/advisories/github-reviewed/2022/05/GHSA-4fx8-82f3-xcpc/GHSA-4fx8-82f3-xcpc.json b/advisories/github-reviewed/2022/05/GHSA-4fx8-82f3-xcpc/GHSA-4fx8-82f3-xcpc.json new file mode 100644 index 00000000000..f3823a119e8 --- /dev/null +++ b/advisories/github-reviewed/2022/05/GHSA-4fx8-82f3-xcpc/GHSA-4fx8-82f3-xcpc.json @@ -0,0 +1,110 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-4fx8-82f3-xcpc", + "modified": "2025-05-28T20:11:03Z", + "published": "2022-05-24T19:02:39Z", + "aliases": [ + "CVE-2021-29048" + ], + "summary": "Liferay Portal and Liferay DXP Vulnerable to Cross-Site Scripting (XSS) in the Layout Admin Page", + "details": "Cross-site scripting (XSS) vulnerability in the Layout module's page administration page in Liferay Portal 7.3.4, 7.3.5 and Liferay DXP 7.2 before fix pack 11 and 7.3 before fix pack 1 allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_layout_admin_web_portlet_GroupPagesPortlet_name parameter.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Maven", + "name": "com.liferay.portal:release.portal.bom" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "7.3.4" + }, + { + "fixed": "7.3.6" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 7.3.5" + } + }, + { + "package": { + "ecosystem": "Maven", + "name": "com.liferay.portal:release.dxp.bom" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "7.2.10.fp11" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Maven", + "name": "com.liferay.portal:release.dxp.bom" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "7.3.0" + }, + { + "fixed": "7.3.10.fp1" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-29048" + }, + { + "type": "PACKAGE", + "url": "https://github.com/liferay/liferay-portal" + }, + { + "type": "WEB", + "url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120743601" + }, + { + "type": "WEB", + "url": "https://web.archive.org/web/20210524222536/https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120743601" + }, + { + "type": "WEB", + "url": "http://liferay.com" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2025-05-28T20:11:03Z", + "nvd_published_at": "2021-05-17T12:15:00Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2022/05/GHSA-jvvx-8g42-9559/GHSA-jvvx-8g42-9559.json b/advisories/github-reviewed/2022/05/GHSA-jvvx-8g42-9559/GHSA-jvvx-8g42-9559.json new file mode 100644 index 00000000000..461332d624d --- /dev/null +++ b/advisories/github-reviewed/2022/05/GHSA-jvvx-8g42-9559/GHSA-jvvx-8g42-9559.json @@ -0,0 +1,129 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-jvvx-8g42-9559", + "modified": "2025-05-28T20:11:08Z", + "published": "2022-05-24T19:02:38Z", + "aliases": [ + "CVE-2021-29051" + ], + "summary": "Liferay Portal and Liferay DXP Vulnerable to Cross-Site Scripting (XSS) in Asset Publisher App", + "details": "Cross-site scripting (XSS) vulnerability in the Asset module's Asset Publisher app in Liferay Portal 7.2.1 through 7.3.5, and Liferay DXP 7.1 before fix pack 21, 7.2 before fix pack 10 and 7.3 before fix pack 1 allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_XXXXXXXXXXXX_assetEntryId parameter.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Maven", + "name": "com.liferay.portal:release.portal.bom" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "7.2.1" + }, + { + "fixed": "7.3.6" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 7.3.5" + } + }, + { + "package": { + "ecosystem": "Maven", + "name": "com.liferay.portal:release.dxp.bom" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "7.1.10.fp21" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Maven", + "name": "com.liferay.portal:release.dxp.bom" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "7.2.0" + }, + { + "fixed": "7.2.10.fp10" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Maven", + "name": "com.liferay.portal:release.dxp.bom" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "7.3.0" + }, + { + "fixed": "7.3.10.fp1" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-29051" + }, + { + "type": "PACKAGE", + "url": "https://github.com/liferay/liferay-portal" + }, + { + "type": "WEB", + "url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120743580" + }, + { + "type": "WEB", + "url": "https://web.archive.org/web/20210524223247/https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120743580" + }, + { + "type": "WEB", + "url": "http://liferay.com" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2025-05-28T20:11:08Z", + "nvd_published_at": "2021-05-17T12:15:00Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-4fx8-82f3-xcpc/GHSA-4fx8-82f3-xcpc.json b/advisories/unreviewed/2022/05/GHSA-4fx8-82f3-xcpc/GHSA-4fx8-82f3-xcpc.json deleted file mode 100644 index e2f99b0d7b9..00000000000 --- a/advisories/unreviewed/2022/05/GHSA-4fx8-82f3-xcpc/GHSA-4fx8-82f3-xcpc.json +++ /dev/null @@ -1,35 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-4fx8-82f3-xcpc", - "modified": "2022-05-24T19:02:39Z", - "published": "2022-05-24T19:02:39Z", - "aliases": [ - "CVE-2021-29048" - ], - "details": "Cross-site scripting (XSS) vulnerability in the Layout module's page administration page in Liferay Portal 7.3.4, 7.3.5 and Liferay DXP 7.2 before fix pack 11 and 7.3 before fix pack 1 allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_layout_admin_web_portlet_GroupPagesPortlet_name parameter.", - "severity": [], - "affected": [], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-29048" - }, - { - "type": "WEB", - "url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120743601" - }, - { - "type": "WEB", - "url": "http://liferay.com" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-79" - ], - "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2021-05-17T12:15:00Z" - } -} \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-jvvx-8g42-9559/GHSA-jvvx-8g42-9559.json b/advisories/unreviewed/2022/05/GHSA-jvvx-8g42-9559/GHSA-jvvx-8g42-9559.json deleted file mode 100644 index 2912d80a0de..00000000000 --- a/advisories/unreviewed/2022/05/GHSA-jvvx-8g42-9559/GHSA-jvvx-8g42-9559.json +++ /dev/null @@ -1,35 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-jvvx-8g42-9559", - "modified": "2022-05-24T19:02:38Z", - "published": "2022-05-24T19:02:38Z", - "aliases": [ - "CVE-2021-29051" - ], - "details": "Cross-site scripting (XSS) vulnerability in the Asset module's Asset Publisher app in Liferay Portal 7.2.1 through 7.3.5, and Liferay DXP 7.1 before fix pack 21, 7.2 before fix pack 10 and 7.3 before fix pack 1 allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_XXXXXXXXXXXX_assetEntryId parameter.", - "severity": [], - "affected": [], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-29051" - }, - { - "type": "WEB", - "url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120743580" - }, - { - "type": "WEB", - "url": "http://liferay.com" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-79" - ], - "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2021-05-17T12:15:00Z" - } -} \ No newline at end of file