Issue
- When a user tries to retrieve the assetEntryId in asset-publisher-web/view.jsp, the content is not validated or escaped. This means XSS could occur.
-
Reproduction Steps:
1. Add 3 journal articles.
2. Add an asset publisher to the home page. The asset publisher should show 3 articles.
3. Click on one of those articles.
4. Click on the back button.
5. Add to the end of the URL "</script><script>alert(1)</script>", replacing the assetEntryID value.
Expected Behavior: No popup.
Actual Behavior: Popup occurs.
Environment
- Liferay DXP 7.2
- Liferay DXP 7.3
Resolution
-
The observed behavior is a Liferay known bug that has been resolved in Liferay 7.2 Fix Pack 10 and Liferay 7.3 Fix Pack 1.
- However, if the hotfix is required for this issue, please create a support ticket requesting the hotfix by attaching the patch details.
- Installing Fix Packs and Hotfixes on Liferay DXP will guide you to install the Fixpack/Hotfix in your environment.
Additional Information
- LPS-124704
- Try the above activity in a lower environment first, if all works well, then move to the production environment as per your own discretion.
- Perform these operations in application server downtime, because these steps require the restart of the server.