diff --git a/advisories/github-reviewed/2022/05/GHSA-239w-4f3w-cfcv/GHSA-239w-4f3w-cfcv.json b/advisories/github-reviewed/2022/05/GHSA-239w-4f3w-cfcv/GHSA-239w-4f3w-cfcv.json new file mode 100644 index 00000000000..e45ac22cca5 --- /dev/null +++ b/advisories/github-reviewed/2022/05/GHSA-239w-4f3w-cfcv/GHSA-239w-4f3w-cfcv.json @@ -0,0 +1,68 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-239w-4f3w-cfcv", + "modified": "2025-05-14T07:45:42Z", + "published": "2022-05-24T19:02:32Z", + "aliases": [ + "CVE-2021-29039" + ], + "summary": "Liferay Portal Vulnerable to Cross-Site Scripting (XSS) via Categories Admin Page", + "details": "Cross-site scripting (XSS) vulnerability in the Asset module's categories administration page in Liferay Portal 7.3.4 allows remote attackers to inject arbitrary web script or HTML via the site name.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Maven", + "name": "com.liferay.portal:release.portal.bom" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "7.3.4" + }, + { + "fixed": "7.3.5" + } + ] + } + ], + "versions": [ + "7.3.4" + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-29039" + }, + { + "type": "PACKAGE", + "url": "https://github.com/liferay/liferay-portal" + }, + { + "type": "WEB", + "url": "https://web.archive.org/web/20220828222833/https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120777766" + }, + { + "type": "WEB", + "url": "http://liferay.com" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2025-05-14T07:45:42Z", + "nvd_published_at": "2021-05-16T15:15:00Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2022/05/GHSA-f9wj-c5pc-g9rh/GHSA-f9wj-c5pc-g9rh.json b/advisories/github-reviewed/2022/05/GHSA-f9wj-c5pc-g9rh/GHSA-f9wj-c5pc-g9rh.json new file mode 100644 index 00000000000..c77c062391a --- /dev/null +++ b/advisories/github-reviewed/2022/05/GHSA-f9wj-c5pc-g9rh/GHSA-f9wj-c5pc-g9rh.json @@ -0,0 +1,87 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-f9wj-c5pc-g9rh", + "modified": "2025-05-14T07:46:34Z", + "published": "2022-05-24T19:02:39Z", + "aliases": [ + "CVE-2021-29053" + ], + "summary": "Liferay Portal and Liferay DXP Vulnerable to Multiple SQL Injections", + "details": "Multiple SQL injection vulnerabilities in Liferay Portal 7.3.5 and Liferay DXP 7.3 before fix pack 1 allow remote authenticated users to execute arbitrary SQL commands via the classPKField parameter to (1) CommerceChannelRelFinder.countByC_C, or (2) CommerceChannelRelFinder.findByC_C.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Maven", + "name": "com.liferay.portal:release.portal.bom" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "7.3.5" + }, + { + "fixed": "7.3.6" + } + ] + } + ], + "versions": [ + "7.3.5" + ] + }, + { + "package": { + "ecosystem": "Maven", + "name": "com.liferay.portal:release.dxp.bom" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "7.3.10.fp1" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-29053" + }, + { + "type": "PACKAGE", + "url": "https://github.com/liferay/liferay-portal" + }, + { + "type": "WEB", + "url": "https://web.archive.org/web/20221121171927/https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120778225" + }, + { + "type": "WEB", + "url": "http://liferay.com" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-89" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2025-05-14T07:46:33Z", + "nvd_published_at": "2021-05-17T11:15:00Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2022/05/GHSA-pr7v-qv65-rp9m/GHSA-pr7v-qv65-rp9m.json b/advisories/github-reviewed/2022/05/GHSA-pr7v-qv65-rp9m/GHSA-pr7v-qv65-rp9m.json new file mode 100644 index 00000000000..0f778618ae5 --- /dev/null +++ b/advisories/github-reviewed/2022/05/GHSA-pr7v-qv65-rp9m/GHSA-pr7v-qv65-rp9m.json @@ -0,0 +1,84 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-pr7v-qv65-rp9m", + "modified": "2025-05-14T07:46:08Z", + "published": "2022-05-24T19:02:38Z", + "aliases": [ + "CVE-2021-29052" + ], + "summary": "Liferay Portal and Liferay DXP Fails to Check Permissions", + "details": "The Data Engine module in Liferay Portal 7.3.0 through 7.3.5, and Liferay DXP 7.3 before fix pack 1 does not check permissions in DataDefinitionResourceImpl.getSiteDataDefinitionByContentTypeByDataDefinitionKey, which allows remote authenticated users to view DDMStructures via GET API calls.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Maven", + "name": "com.liferay.portal:release.portal.bom" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "7.3.0" + }, + { + "last_affected": "7.3.5" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Maven", + "name": "com.liferay.portal:release.dxp.bom" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "7.3.10.fp1" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-29052" + }, + { + "type": "PACKAGE", + "url": "https://github.com/liferay/liferay-portal" + }, + { + "type": "WEB", + "url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120743159" + }, + { + "type": "WEB", + "url": "http://liferay.com" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-276" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2025-05-14T07:46:08Z", + "nvd_published_at": "2021-05-17T12:15:00Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-239w-4f3w-cfcv/GHSA-239w-4f3w-cfcv.json b/advisories/unreviewed/2022/05/GHSA-239w-4f3w-cfcv/GHSA-239w-4f3w-cfcv.json deleted file mode 100644 index 0a26e20d4eb..00000000000 --- a/advisories/unreviewed/2022/05/GHSA-239w-4f3w-cfcv/GHSA-239w-4f3w-cfcv.json +++ /dev/null @@ -1,35 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-239w-4f3w-cfcv", - "modified": "2022-05-24T19:02:32Z", - "published": "2022-05-24T19:02:32Z", - "aliases": [ - "CVE-2021-29039" - ], - "details": "Cross-site scripting (XSS) vulnerability in the Asset module's categories administration page in Liferay Portal 7.3.4 allows remote attackers to inject arbitrary web script or HTML via the site name.", - "severity": [], - "affected": [], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-29039" - }, - { - "type": "WEB", - "url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120777766" - }, - { - "type": "WEB", - "url": "http://liferay.com" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-79" - ], - "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2021-05-16T15:15:00Z" - } -} \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-f9wj-c5pc-g9rh/GHSA-f9wj-c5pc-g9rh.json b/advisories/unreviewed/2022/05/GHSA-f9wj-c5pc-g9rh/GHSA-f9wj-c5pc-g9rh.json deleted file mode 100644 index b2e3305fae3..00000000000 --- a/advisories/unreviewed/2022/05/GHSA-f9wj-c5pc-g9rh/GHSA-f9wj-c5pc-g9rh.json +++ /dev/null @@ -1,35 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-f9wj-c5pc-g9rh", - "modified": "2022-05-24T19:02:39Z", - "published": "2022-05-24T19:02:39Z", - "aliases": [ - "CVE-2021-29053" - ], - "details": "Multiple SQL injection vulnerabilities in Liferay Portal 7.3.5 and Liferay DXP 7.3 before fix pack 1 allow remote authenticated users to execute arbitrary SQL commands via the classPKField parameter to (1) CommerceChannelRelFinder.countByC_C, or (2) CommerceChannelRelFinder.findByC_C.", - "severity": [], - "affected": [], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-29053" - }, - { - "type": "WEB", - "url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120778225" - }, - { - "type": "WEB", - "url": "http://liferay.com" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-89" - ], - "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2021-05-17T11:15:00Z" - } -} \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-pr7v-qv65-rp9m/GHSA-pr7v-qv65-rp9m.json b/advisories/unreviewed/2022/05/GHSA-pr7v-qv65-rp9m/GHSA-pr7v-qv65-rp9m.json deleted file mode 100644 index 53eb711acdc..00000000000 --- a/advisories/unreviewed/2022/05/GHSA-pr7v-qv65-rp9m/GHSA-pr7v-qv65-rp9m.json +++ /dev/null @@ -1,35 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-pr7v-qv65-rp9m", - "modified": "2022-05-24T19:02:38Z", - "published": "2022-05-24T19:02:38Z", - "aliases": [ - "CVE-2021-29052" - ], - "details": "The Data Engine module in Liferay Portal 7.3.0 through 7.3.5, and Liferay DXP 7.3 before fix pack 1 does not check permissions in DataDefinitionResourceImpl.getSiteDataDefinitionByContentTypeByDataDefinitionKey, which allows remote authenticated users to view DDMStructures via GET API calls.", - "severity": [], - "affected": [], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-29052" - }, - { - "type": "WEB", - "url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120743159" - }, - { - "type": "WEB", - "url": "http://liferay.com" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-276" - ], - "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2021-05-17T12:15:00Z" - } -} \ No newline at end of file