From 5d1b1a4e233e8af433a04ed4c18bd52064c35067 Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
 <45398580+advisory-database[bot]@users.noreply.github.com>
Date: Wed, 18 Dec 2024 15:39:59 +0000
Subject: [PATCH] Publish Advisories

GHSA-px38-239g-x5mg
GHSA-px38-239g-x5mg
---
 .../GHSA-px38-239g-x5mg.json                  | 99 +++++++++++++++++++
 .../GHSA-px38-239g-x5mg.json                  | 36 -------
 2 files changed, 99 insertions(+), 36 deletions(-)
 create mode 100644 advisories/github-reviewed/2024/12/GHSA-px38-239g-x5mg/GHSA-px38-239g-x5mg.json
 delete mode 100644 advisories/unreviewed/2024/12/GHSA-px38-239g-x5mg/GHSA-px38-239g-x5mg.json

diff --git a/advisories/github-reviewed/2024/12/GHSA-px38-239g-x5mg/GHSA-px38-239g-x5mg.json b/advisories/github-reviewed/2024/12/GHSA-px38-239g-x5mg/GHSA-px38-239g-x5mg.json
new file mode 100644
index 00000000000..5bd5fddda75
--- /dev/null
+++ b/advisories/github-reviewed/2024/12/GHSA-px38-239g-x5mg/GHSA-px38-239g-x5mg.json
@@ -0,0 +1,99 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-px38-239g-x5mg",
+  "modified": "2024-12-18T15:38:29Z",
+  "published": "2024-12-18T00:31:23Z",
+  "aliases": [
+    "CVE-2023-37940"
+  ],
+  "summary": "Liferay Portal and Liferay DXP have Cross-site Scripting vulnerability in edit Service Access Policy page",
+  "details": "Cross-site scripting (XSS) vulnerability in the edit Service Access Policy page in Liferay Portal 7.0.0 through 7.4.3.87, and Liferay DXP 7.4 GA through update 87, 7.3 GA through update 29, and older unsupported versions allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a service access policy's `Service Class` text field.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Maven",
+        "name": "com.liferay.portal:release.portal.bom"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "7.0.0"
+            },
+            {
+              "fixed": "7.4.3.88"
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "package": {
+        "ecosystem": "Maven",
+        "name": "com.liferay.portal:release.dxp.bom"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "7.0"
+            },
+            {
+              "fixed": "7.3.10.u30"
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "package": {
+        "ecosystem": "Maven",
+        "name": "com.liferay.portal:release.dxp.bom"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "7.4"
+            },
+            {
+              "fixed": "7.4.13.u88"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-37940"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/liferay/liferay-portal"
+    },
+    {
+      "type": "WEB",
+      "url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2023-37940"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-79"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": true,
+    "github_reviewed_at": "2024-12-18T15:38:29Z",
+    "nvd_published_at": "2024-12-17T22:15:05Z"
+  }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2024/12/GHSA-px38-239g-x5mg/GHSA-px38-239g-x5mg.json b/advisories/unreviewed/2024/12/GHSA-px38-239g-x5mg/GHSA-px38-239g-x5mg.json
deleted file mode 100644
index c948f796f7c..00000000000
--- a/advisories/unreviewed/2024/12/GHSA-px38-239g-x5mg/GHSA-px38-239g-x5mg.json
+++ /dev/null
@@ -1,36 +0,0 @@
-{
-  "schema_version": "1.4.0",
-  "id": "GHSA-px38-239g-x5mg",
-  "modified": "2024-12-18T00:31:23Z",
-  "published": "2024-12-18T00:31:23Z",
-  "aliases": [
-    "CVE-2023-37940"
-  ],
-  "details": "Cross-site scripting (XSS) vulnerability in the edit Service Access Policy page in Liferay Portal 7.0.0 through 7.4.3.87, and Liferay DXP 7.4 GA through update 87, 7.3 GA through update 29, and older unsupported versions allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a service access policy's `Service Class` text field.",
-  "severity": [
-    {
-      "type": "CVSS_V3",
-      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
-    }
-  ],
-  "affected": [],
-  "references": [
-    {
-      "type": "ADVISORY",
-      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-37940"
-    },
-    {
-      "type": "WEB",
-      "url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2023-37940"
-    }
-  ],
-  "database_specific": {
-    "cwe_ids": [
-      "CWE-79"
-    ],
-    "severity": "MODERATE",
-    "github_reviewed": false,
-    "github_reviewed_at": null,
-    "nvd_published_at": "2024-12-17T22:15:05Z"
-  }
-}
\ No newline at end of file