diff --git a/advisories/github-reviewed/2022/05/GHSA-6c88-gvxw-f5hg/GHSA-6c88-gvxw-f5hg.json b/advisories/github-reviewed/2022/05/GHSA-6c88-gvxw-f5hg/GHSA-6c88-gvxw-f5hg.json new file mode 100644 index 00000000000..c7582eced3b --- /dev/null +++ b/advisories/github-reviewed/2022/05/GHSA-6c88-gvxw-f5hg/GHSA-6c88-gvxw-f5hg.json @@ -0,0 +1,122 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-6c88-gvxw-f5hg", + "modified": "2025-05-14T07:50:26Z", + "published": "2022-05-24T19:09:46Z", + "aliases": [ + "CVE-2021-33325" + ], + "summary": "Liferay Portal and Liferay DXP Stores User Passwords in Cleartext", + "details": "The Portal Workflow module in Liferay Portal 7.3.2 and earlier, and Liferay DXP 7.0 before fix pack 93, 7.1 before fix pack 19, and 7.2 before fix pack 7, user's clear text passwords are stored in the database if workflow is enabled for user creation, which allows attackers with access to the database to obtain a user's password.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Maven", + "name": "com.liferay.portal:release.portal.bom" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "7.3.0" + }, + { + "last_affected": "7.3.2" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Maven", + "name": "com.liferay.portal:release.dxp.bom" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "7.0.10.fp93" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Maven", + "name": "com.liferay.portal:release.dxp.bom" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "7.1.0" + }, + { + "fixed": "7.1.10.fp19" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Maven", + "name": "com.liferay.portal:release.dxp.bom" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "7.2.0" + }, + { + "fixed": "7.2.10.fp7" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-33325" + }, + { + "type": "PACKAGE", + "url": "https://github.com/liferay/liferay-portal" + }, + { + "type": "WEB", + "url": "https://issues.liferay.com/browse/LPE-17042" + }, + { + "type": "WEB", + "url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120748389" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-312" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2025-05-14T07:50:26Z", + "nvd_published_at": "2021-08-03T19:15:00Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2022/05/GHSA-g37f-j8hh-736f/GHSA-g37f-j8hh-736f.json b/advisories/github-reviewed/2022/05/GHSA-g37f-j8hh-736f/GHSA-g37f-j8hh-736f.json new file mode 100644 index 00000000000..9c3cb052164 --- /dev/null +++ b/advisories/github-reviewed/2022/05/GHSA-g37f-j8hh-736f/GHSA-g37f-j8hh-736f.json @@ -0,0 +1,122 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-g37f-j8hh-736f", + "modified": "2025-05-14T07:51:00Z", + "published": "2022-05-24T19:09:41Z", + "aliases": [ + "CVE-2021-33334" + ], + "summary": "Liferay Portal and Liferay DXP Fails to Properly Check User Permissions", + "details": "The Dynamic Data Mapping module in Liferay Portal 7.0.0 through 7.3.2, and Liferay DXP 7.0 before fix pack 94, 7.1 before fix pack 19, and 7.2 before fix pack 6, does not properly check user permissions, which allows remote attackers with the forms \"Access in Site Administration\" permission to view all forms and form entries in a site via the forms section in site administration.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Maven", + "name": "com.liferay.portal:release.portal.bom" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "7.0.0" + }, + { + "last_affected": "7.3.2" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Maven", + "name": "com.liferay.portal:release.dxp.bom" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "7.0.10.fp0" + }, + { + "fixed": "7.0.10.fp94" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Maven", + "name": "com.liferay.portal:release.dxp.bom" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "7.1.0" + }, + { + "fixed": "7.1.10.fp19" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Maven", + "name": "com.liferay.portal:release.dxp.bom" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "7.2.0" + }, + { + "fixed": "7.2.10.fp6" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-33334" + }, + { + "type": "PACKAGE", + "url": "https://github.com/liferay/liferay-portal" + }, + { + "type": "WEB", + "url": "https://issues.liferay.com/browse/LPE-17039" + }, + { + "type": "WEB", + "url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120748332" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-276" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2025-05-14T07:51:00Z", + "nvd_published_at": "2021-08-03T21:15:00Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2022/05/GHSA-vpvm-3wfw-5f5c/GHSA-vpvm-3wfw-5f5c.json b/advisories/github-reviewed/2022/05/GHSA-vpvm-3wfw-5f5c/GHSA-vpvm-3wfw-5f5c.json new file mode 100644 index 00000000000..68f31b088a1 --- /dev/null +++ b/advisories/github-reviewed/2022/05/GHSA-vpvm-3wfw-5f5c/GHSA-vpvm-3wfw-5f5c.json @@ -0,0 +1,122 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-vpvm-3wfw-5f5c", + "modified": "2025-05-14T07:50:44Z", + "published": "2022-05-24T19:09:46Z", + "aliases": [ + "CVE-2021-33328" + ], + "summary": "Liferay Portal and Liferay DXP Vulnerable to Cross-Site Scripting (XSS) in Edit Vocabulary Page", + "details": "Cross-site scripting (XSS) vulnerability in the Asset module's edit vocabulary page in Liferay Portal 7.0.0 through 7.3.4, and Liferay DXP 7.0 before fix pack 96, 7.1 before fix pack 20, and 7.2 before fix pack 9, allows remote attackers to inject arbitrary web script or HTML via the (1) _com_liferay_journal_web_portlet_JournalPortlet_name or (2) _com_liferay_document_library_web_portlet_DLAdminPortlet_name parameter.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Maven", + "name": "com.liferay.portal:release.portal.bom" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "7.0.0" + }, + { + "last_affected": "7.3.4" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Maven", + "name": "com.liferay.portal:release.dxp.bom" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "7.0.10.fp0" + }, + { + "fixed": "7.0.10.fp96" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Maven", + "name": "com.liferay.portal:release.dxp.bom" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "7.1.0" + }, + { + "fixed": "7.1.10.fp20" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Maven", + "name": "com.liferay.portal:release.dxp.bom" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "7.2.0" + }, + { + "fixed": "7.2.10.fp9" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-33328" + }, + { + "type": "PACKAGE", + "url": "https://github.com/liferay/liferay-portal" + }, + { + "type": "WEB", + "url": "https://issues.liferay.com/browse/LPE-17100" + }, + { + "type": "WEB", + "url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120747972" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2025-05-14T07:50:44Z", + "nvd_published_at": "2021-08-03T19:15:00Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2022/05/GHSA-w28v-87g6-cjr6/GHSA-w28v-87g6-cjr6.json b/advisories/github-reviewed/2022/05/GHSA-w28v-87g6-cjr6/GHSA-w28v-87g6-cjr6.json new file mode 100644 index 00000000000..9932bf4068a --- /dev/null +++ b/advisories/github-reviewed/2022/05/GHSA-w28v-87g6-cjr6/GHSA-w28v-87g6-cjr6.json @@ -0,0 +1,122 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-w28v-87g6-cjr6", + "modified": "2025-05-14T07:51:34Z", + "published": "2022-05-24T22:01:39Z", + "aliases": [ + "CVE-2021-29049" + ], + "summary": "Liferay DXP Vulnerable to Cross-Site Scripting (XSS) via the currentURL Parameter", + "details": "Cross-site scripting (XSS) vulnerability in the Portal Workflow module's edit process page in Liferay DXP 7.0 before fix pack 99, 7.1 before fix pack 23, 7.2 before fix pack 12 and 7.3 before fix pack 1, allows remote attackers to inject arbitrary web script or HTML via the currentURL parameter.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Maven", + "name": "com.liferay.portal:release.dxp.bom" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "7.0" + }, + { + "fixed": "7.0.10.fp99" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Maven", + "name": "com.liferay.portal:release.dxp.bom" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "7.1.0" + }, + { + "fixed": "7.1.10.fp23" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Maven", + "name": "com.liferay.portal:release.dxp.bom" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "7.2.0" + }, + { + "fixed": "7.2.10.fp12" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Maven", + "name": "com.liferay.portal:release.dxp.bom" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "7.3.0" + }, + { + "fixed": "7.3.10.fp1" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-29049" + }, + { + "type": "PACKAGE", + "url": "https://github.com/liferay/liferay-portal" + }, + { + "type": "WEB", + "url": "https://issues.liferay.com/browse/LPE-17211" + }, + { + "type": "WEB", + "url": "http://liferay.com" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2025-05-14T07:51:34Z", + "nvd_published_at": "2021-06-09T19:15:00Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-6c88-gvxw-f5hg/GHSA-6c88-gvxw-f5hg.json b/advisories/unreviewed/2022/05/GHSA-6c88-gvxw-f5hg/GHSA-6c88-gvxw-f5hg.json deleted file mode 100644 index ec1e7ae5687..00000000000 --- a/advisories/unreviewed/2022/05/GHSA-6c88-gvxw-f5hg/GHSA-6c88-gvxw-f5hg.json +++ /dev/null @@ -1,35 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-6c88-gvxw-f5hg", - "modified": "2022-05-24T19:09:46Z", - "published": "2022-05-24T19:09:46Z", - "aliases": [ - "CVE-2021-33325" - ], - "details": "The Portal Workflow module in Liferay Portal 7.3.2 and earlier, and Liferay DXP 7.0 before fix pack 93, 7.1 before fix pack 19, and 7.2 before fix pack 7, user's clear text passwords are stored in the database if workflow is enabled for user creation, which allows attackers with access to the database to obtain a user's password.", - "severity": [], - "affected": [], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-33325" - }, - { - "type": "WEB", - "url": "https://issues.liferay.com/browse/LPE-17042" - }, - { - "type": "WEB", - "url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120748389" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-312" - ], - "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2021-08-03T19:15:00Z" - } -} \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-g37f-j8hh-736f/GHSA-g37f-j8hh-736f.json b/advisories/unreviewed/2022/05/GHSA-g37f-j8hh-736f/GHSA-g37f-j8hh-736f.json deleted file mode 100644 index 6edf3810936..00000000000 --- a/advisories/unreviewed/2022/05/GHSA-g37f-j8hh-736f/GHSA-g37f-j8hh-736f.json +++ /dev/null @@ -1,35 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-g37f-j8hh-736f", - "modified": "2022-05-24T19:09:41Z", - "published": "2022-05-24T19:09:41Z", - "aliases": [ - "CVE-2021-33334" - ], - "details": "The Dynamic Data Mapping module in Liferay Portal 7.0.0 through 7.3.2, and Liferay DXP 7.0 before fix pack 94, 7.1 before fix pack 19, and 7.2 before fix pack 6, does not properly check user permissions, which allows remote attackers with the forms \"Access in Site Administration\" permission to view all forms and form entries in a site via the forms section in site administration.", - "severity": [], - "affected": [], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-33334" - }, - { - "type": "WEB", - "url": "https://issues.liferay.com/browse/LPE-17039" - }, - { - "type": "WEB", - "url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120748332" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-276" - ], - "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2021-08-03T21:15:00Z" - } -} \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-vpvm-3wfw-5f5c/GHSA-vpvm-3wfw-5f5c.json b/advisories/unreviewed/2022/05/GHSA-vpvm-3wfw-5f5c/GHSA-vpvm-3wfw-5f5c.json deleted file mode 100644 index 1bf864cb56d..00000000000 --- a/advisories/unreviewed/2022/05/GHSA-vpvm-3wfw-5f5c/GHSA-vpvm-3wfw-5f5c.json +++ /dev/null @@ -1,35 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-vpvm-3wfw-5f5c", - "modified": "2022-05-24T19:09:46Z", - "published": "2022-05-24T19:09:46Z", - "aliases": [ - "CVE-2021-33328" - ], - "details": "Cross-site scripting (XSS) vulnerability in the Asset module's edit vocabulary page in Liferay Portal 7.0.0 through 7.3.4, and Liferay DXP 7.0 before fix pack 96, 7.1 before fix pack 20, and 7.2 before fix pack 9, allows remote attackers to inject arbitrary web script or HTML via the (1) _com_liferay_journal_web_portlet_JournalPortlet_name or (2) _com_liferay_document_library_web_portlet_DLAdminPortlet_name parameter.", - "severity": [], - "affected": [], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-33328" - }, - { - "type": "WEB", - "url": "https://issues.liferay.com/browse/LPE-17100" - }, - { - "type": "WEB", - "url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120747972" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-79" - ], - "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2021-08-03T19:15:00Z" - } -} \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-w28v-87g6-cjr6/GHSA-w28v-87g6-cjr6.json b/advisories/unreviewed/2022/05/GHSA-w28v-87g6-cjr6/GHSA-w28v-87g6-cjr6.json deleted file mode 100644 index 876fa7249d2..00000000000 --- a/advisories/unreviewed/2022/05/GHSA-w28v-87g6-cjr6/GHSA-w28v-87g6-cjr6.json +++ /dev/null @@ -1,35 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-w28v-87g6-cjr6", - "modified": "2022-05-24T22:01:39Z", - "published": "2022-05-24T22:01:39Z", - "aliases": [ - "CVE-2021-29049" - ], - "details": "Cross-site scripting (XSS) vulnerability in the Portal Workflow module's edit process page in Liferay DXP 7.0 before fix pack 99, 7.1 before fix pack 23, 7.2 before fix pack 12 and 7.3 before fix pack 1, allows remote attackers to inject arbitrary web script or HTML via the currentURL parameter.", - "severity": [], - "affected": [], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-29049" - }, - { - "type": "WEB", - "url": "https://issues.liferay.com/browse/LPE-17211" - }, - { - "type": "WEB", - "url": "http://liferay.com" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-79" - ], - "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2021-06-09T19:15:00Z" - } -} \ No newline at end of file