deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-rpx3-f938-xj5q
Package: com.liferay:com.liferay.saml.impl (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-613: Insufficient Session Expiration
Vulnerable versions: < 5.0.51
Patched in: 5.0.51

Summary: Liferay Portal and DXP does not properly expire sessions

Details:
### Summary

Liferay Portal/DXP contains an Insufficient Session Expiration issue where the Single Logout (SLO) API may fail to invalidate a user’s previous session. An attacker can reuse a stale session via the SLO endpoint to gain an authenticated context.

### Affected Versions

The following platform versions are affected:

*   **Liferay Portal:**  
    *   `7.3.3.131` through `7.4.3.121`
*   **Liferay DXP:**
    *   `2024.Q4.0`–`2024.Q4.3`
    *   `2024.Q3.1`–`2024.Q3.13`
    *   `2024.Q2.0`–`2024.Q2.13`
    *   `2024.Q1.1`–`2024.Q1.12`

### Remediation

Update to the fixed builds and, for Maven consumers of the SAML module, upgrade `com.liferay:com.liferay.saml.impl` to **5.0.51** or later. After upgrading, ensure session invalidation policies are enforced and verify SLO behavior end-to-end.
GitHub Security Advisory: GHSA-7phw-cxx7-q9vq
Package: org.springframework:spring-webmvc (MAVEN)
Severity: CRITICAL (CVSS 9.1)
Vulnerable versions: >= 5.3.0, < 5.3.26
Patched in: 5.3.26

Summary: Spring Framework is vulnerable to security bypass via mvcRequestMatcher pattern mismatch

Details:
Spring Framework running version 6.0.0 - 6.0.6 or 5.3.0 - 5.3.25 using "**" as a pattern in Spring Security configuration with the mvcRequestMatcher creates a mismatch in pattern matching between Spring Security and Spring MVC, and the potential for a security bypass.
GitHub Security Advisory: GHSA-7phw-cxx7-q9vq
Package: org.springframework:spring-webmvc (MAVEN)
Severity: CRITICAL (CVSS 9.1)
Vulnerable versions: >= 6.0.0, < 6.0.7
Patched in: 6.0.7

Summary: Spring Framework is vulnerable to security bypass via mvcRequestMatcher pattern mismatch

Details:
Spring Framework running version 6.0.0 - 6.0.6 or 5.3.0 - 5.3.25 using "**" as a pattern in Spring Security configuration with the mvcRequestMatcher creates a mismatch in pattern matching between Spring Security and Spring MVC, and the potential for a security bypass.
GitHub Security Advisory: GHSA-r6f3-55wj-g9p3
Package: org.wso2.identity.apps:authentication-portal (MAVEN)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-451: User Interface (UI) Misrepresentation of Critical Information
Vulnerable versions: < 2.4.4
Patched in: 2.4.4

Summary: WSO2 Identity Server Apps allows content spoofing in logs

Details:
A content spoofing issue exists in WSO2 Identity Server Apps, specifically in the Authentication Portal, due to improper handling of authentication error messages. When an authentication failure occurs, the portal previously accepted an `authFailureMsg` value supplied via URL and rendered it in the UI without validating it against the resource bundle. An attacker can craft a link that causes the portal to display attacker-controlled text in the error banner, enabling UI misrepresentation and social-engineering.

The fix validates the message key against the resource bundle and encodes input before rendering. Upgrade to `org.wso2.identity.apps:authentication-portal` **2.4.4** or later to remediate.
GitHub Security Advisory: GHSA-hrmc-jmp7-mpm2
Package: ai.h2o:h2o-core (MAVEN)
Severity: CRITICAL (CVSS 9.1)
CWE: CWE-502: Deserialization of Untrusted Data
Vulnerable versions: <= 3.46.0.7
Patched in: unpatched

Summary: H2O.ai H2O vulnerable to deserialization attacks via a JDBC Connection URL

Details:
H2O.ai H2O through 3.46.0.4 allows attackers to arbitrarily set the JDBC URL, leading to deserialization attacks, file reads, and command execution. Exploitation can occur when an attacker has access to post to the ImportSQLTable URI with a JSON document containing a connection_url property with any typical JDBC Connection URL attack payload such as one that uses queryInterceptors.
GitHub Security Advisory: GHSA-49mj-77q5-qw5g
Package: org.springframework.batch:spring-batch-admin-manager (MAVEN)
Severity: MODERATE (CVSS 5.4)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 1.3.0.RELEASE
Patched in: 1.3.0.RELEASE

Summary: Spring Batch Admin vulnerable to Stored Cross-site scripting (XSS) in the file upload functionality

Details:
Stored Cross-site scripting (XSS) vulnerability in Spring Batch Admin before 1.3.0 allows remote authenticated users to inject arbitrary JavaScript or HTML via the file upload functionality.
GitHub Security Advisory: GHSA-274r-p6v6-fhh4
Package: org.springframework.batch:spring-batch-admin-manager (MAVEN)
Severity: HIGH (CVSS 8.8)
CWE: CWE-352: Cross-Site Request Forgery (CSRF)
Vulnerable versions: < 1.3.0.RELEASE
Patched in: 1.3.0.RELEASE

Summary: Spring Batch Admin vulnerable to Cross-site request forgery (CSRF) in the file upload functionality

Details:
Cross-site request forgery (CSRF) vulnerability in the Spring Batch Admin before 1.3.0 allows remote attackers to hijack the authentication of unspecified victims and submit arbitrary requests, such as exploiting the file upload vulnerability.
GitHub Security Advisory: GHSA-cmjc-qp7j-xgwr
Package: org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.rest.api.publisher.v1 (MAVEN)
Severity: MODERATE (CVSS 4.8)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 9.31.117
Patched in: 9.31.117

Summary: WSO2 carbon-apimgt affected by an authenticated stored cross-site scripting (XSS) vulnerability

Details:
An authenticated stored Cross-Site Scripting (XSS) vulnerability exists in WSO2 API Manager components (`carbon-apimgt`) due to insufficient validation of user-supplied input during API document upload in the Publisher portal.

A user with publisher privileges can upload a crafted API document whose contents are later rendered in the UI for other users, leading to attacker-controlled script execution. Likely outcomes include redirection to malicious sites, unauthorized UI modifications, or exfiltration of data accessible to the browser; session hijacking is mitigated by the use of `HttpOnly` session cookies.

To remediate, update to version 9.31.117 or above.
GitHub Security Advisory: GHSA-cmjc-qp7j-xgwr
Package: org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.api (MAVEN)
Severity: MODERATE (CVSS 4.8)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 9.31.117
Patched in: 9.31.117

Summary: WSO2 carbon-apimgt affected by an authenticated stored cross-site scripting (XSS) vulnerability

Details:
An authenticated stored Cross-Site Scripting (XSS) vulnerability exists in WSO2 API Manager components (`carbon-apimgt`) due to insufficient validation of user-supplied input during API document upload in the Publisher portal.

A user with publisher privileges can upload a crafted API document whose contents are later rendered in the UI for other users, leading to attacker-controlled script execution. Likely outcomes include redirection to malicious sites, unauthorized UI modifications, or exfiltration of data accessible to the browser; session hijacking is mitigated by the use of `HttpOnly` session cookies.

To remediate, update to version 9.31.117 or above.
GitHub Security Advisory: GHSA-3wc8-659g-r88q
Package: org.springframework.batch:spring-batch-core (MAVEN)
Severity: LOW (CVSS 0.0)
CWE: CWE-611: Improper Restriction of XML External Entity Reference
Vulnerable versions: = 4.1.0.RELEASE
Patched in: 4.1.1.RELEASE

Summary: Low severity vulnerability that affects org.springframework.batch:spring-batch-core

Details:
Spring Batch versions 3.0.9, 4.0.1, 4.1.0, and older unsupported versions, were susceptible to XML External Entity Injection (XXE) when receiving XML data from untrusted sources.
GitHub Security Advisory: GHSA-3wc8-659g-r88q
Package: org.springframework.batch:spring-batch-core (MAVEN)
Severity: LOW (CVSS 0.0)
CWE: CWE-611: Improper Restriction of XML External Entity Reference
Vulnerable versions: >= 4.0.0.RELEASE, < 4.0.2.RELEASE
Patched in: 4.0.2.RELEASE

Summary: Low severity vulnerability that affects org.springframework.batch:spring-batch-core

Details:
Spring Batch versions 3.0.9, 4.0.1, 4.1.0, and older unsupported versions, were susceptible to XML External Entity Injection (XXE) when receiving XML data from untrusted sources.
GitHub Security Advisory: GHSA-3wc8-659g-r88q
Package: org.springframework.batch:spring-batch-core (MAVEN)
Severity: LOW (CVSS 0.0)
CWE: CWE-611: Improper Restriction of XML External Entity Reference
Vulnerable versions: < 3.0.10.RELEASE
Patched in: 3.0.10.RELEASE

Summary: Low severity vulnerability that affects org.springframework.batch:spring-batch-core

Details:
Spring Batch versions 3.0.9, 4.0.1, 4.1.0, and older unsupported versions, were susceptible to XML External Entity Injection (XXE) when receiving XML data from untrusted sources.
GitHub Security Advisory: GHSA-ph63-chvv-8x46
Package: com.liferay:com.liferay.portal.security.audit.event.generators.user.management (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-201: Insertion of Sensitive Information Into Sent Data
Vulnerable versions: < 5.0.13
Patched in: 5.0.13

Summary: Liferay Portal and DXP audit events record password reminder answers

Details:
In Liferay Portal 7.4.0 through 7.4.3.112, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.8, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and older unsupported versions the audit events records a user’s password reminder answer, which allows remote authenticated users to obtain a user’s password reminder answer via the audit events.
GitHub Security Advisory: GHSA-f372-9rcj-8w2c
Package: com.liferay.commerce:com.liferay.commerce.service (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-639: Authorization Bypass Through User-Controlled Key
Vulnerable versions: < 11.0.164
Patched in: 11.0.164

Summary: Liferay Portal and DXP allows users to add a note to a different virtual instance

Details:
Insecure Direct Object Reference (IDOR) vulnerability with commerce order notes in Liferay Portal 7.3.5 through 7.4.3.112, and Liferay DXP 2023.Q4.0 through 2023.Q4.8, 2023.Q3.1 through 2023.Q3.10, and 7.4 GA through update 92 allows remote authenticated users to from one virtual instance to add a note to an order in a different virtual instance via the _com_liferay_commerce_order_web_internal_portlet_CommerceOrderPortlet_commerceOrderId parameter.
GitHub Security Advisory: GHSA-pm45-xx4q-fmv7
Package: com.liferay:com.liferay.batch.engine.service (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-863: Incorrect Authorization
Vulnerable versions: < 4.0.102
Patched in: 4.0.102

Summary: Liferay Portal and DXP does not properly check permission with import and export tasks

Details:
Batch Engine in Liferay Portal 7.4.0 through 7.4.3.112, and Liferay DXP 2023.Q4.0 through 2023.Q4.7, 2023.Q3.1 through 2023.Q3.10, and 7.4 GA through update 92 does not properly check permission with import and export tasks, which allows remote authenticated users to access the exported data via the REST APIs.
GitHub Security Advisory: GHSA-pm45-xx4q-fmv7
Package: com.liferay:com.liferay.headless.batch.engine.impl (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-863: Incorrect Authorization
Vulnerable versions: < 4.0.52
Patched in: 4.0.52

Summary: Liferay Portal and DXP does not properly check permission with import and export tasks

Details:
Batch Engine in Liferay Portal 7.4.0 through 7.4.3.112, and Liferay DXP 2023.Q4.0 through 2023.Q4.7, 2023.Q3.1 through 2023.Q3.10, and 7.4 GA through update 92 does not properly check permission with import and export tasks, which allows remote authenticated users to access the exported data via the REST APIs.
GitHub Security Advisory: GHSA-jh9h-8xf2-25wj
Package: com.liferay:com.liferay.change.tracking.service (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 3.0.91
Patched in: 3.0.91

Summary: Liferay has a stored cross-site scripting (XSS) vulnerability via a a publication’s “Name” text field

Details:
Stored cross-site scripting (XSS) vulnerability in the notifications widget in Liferay Portal 7.4.0 through 7.4.3.112, and Liferay DXP 2023.Q4.0 through 2023.Q4.8, 2023.Q3.1 through 2023.Q3.10, and 7.4 GA through update 92 allows remote attackers to inject arbitrary web scripts or HTML via a crafted payload injected into a publication’s “Name” text field.
GitHub Security Advisory: GHSA-5w3j-gwgh-4rfv
Package: ai.h2o:h2o-core (MAVEN)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-502: Deserialization of Untrusted Data
Vulnerable versions: <= 3.46.0.7
Patched in: unpatched

Summary: H2O affected by a deserialization vulnerability

Details:
A deserialization vulnerability exists in h2oai/h2o-3 versions <= 3.46.0.7, allowing attackers to read arbitrary system files and execute arbitrary code. The vulnerability arises from improper handling of JDBC connection parameters, which can be exploited by bypassing regular expression checks and using double URL encoding. This issue impacts all users of the affected versions.
GitHub Security Advisory: GHSA-chr3-w547-85hw
Package: com.liferay.commerce:com.liferay.commerce.product.type.virtual.service (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-732: Incorrect Permission Assignment for Critical Resource
Vulnerable versions: < 4.0.47
Patched in: 4.0.47

Summary: Liferay Portal Commerce component has Incorrect Permission Assignment for Critical Resource

Details:
The Commerce component in Liferay Portal 7.3.0 through 7.4.3.112, and Liferay DXP 2023.Q4.0 through 2023.Q4.8, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and 7.3 Service Pack 3 through update 35 saves virtual products uploaded to Documents and Media with guest view permission, which allows remote attackers to access and download virtual products for free via a crafted URL.
GitHub Security Advisory: GHSA-697h-3q6m-jwp4
Package: com.liferay.portal:com.liferay.portal.impl (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-352: Cross-Site Request Forgery (CSRF)
Vulnerable versions: < 101.0.0
Patched in: 101.0.0

Summary: Liferay Portal Cross-Site Request Forgery (CSRF) vulnerability

Details:
Cross-Site Request Forgery (CSRF) vulnerability in the server (license) registration page in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.7, 2023.Q3.1 through 2023.Q3.9, 7.4 GA through update 92, and older unsupported versions allows remote attackers to register a server license via the 'orderUuid' parameter.
GitHub Security Advisory: GHSA-8c8v-r5jj-4425
Package: com.liferay:com.liferay.contacts.web (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-639: Authorization Bypass Through User-Controlled Key
Vulnerable versions: < 5.0.59
Patched in: 5.0.59

Summary: Liferay Contacts Center widget has insecure direct object reference

Details:
Insecure direct object reference (IDOR) vulnerability in the Contacts Center widget in Liferay Portal 7.4.0 through 7.4.3.119, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.6, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and older unsupported versions allows remote attackers to view contact information, including the contact’s name and email address, via the _com_liferay_contacts_web_portlet_ContactsCenterPortlet_entryId parameter.
GitHub Security Advisory: GHSA-xwmg-2g98-w7v9
Package: com.nimbusds:nimbus-jose-jwt (MAVEN)
Severity: MODERATE (CVSS 5.8)
CWE: CWE-674: Uncontrolled Recursion
Vulnerable versions: >= 9.38-rc1, < 10.0.2
Patched in: 10.0.2

Summary: Nimbus JOSE + JWT is vulnerable to DoS attacks when processing deeply nested JSON

Details:
Connect2id Nimbus JOSE + JWT before 10.0.2 allows a remote attacker to cause a denial of service via a deeply nested JSON object supplied in a JWT claim set, because of uncontrolled recursion. NOTE: this is independent of the Gson 2.11.0 issue because the Connect2id product could have checked the JSON object nesting depth, regardless of what limits (if any) were imposed by Gson.
GitHub Security Advisory: GHSA-qrh5-jg98-cr48
Package: org.jenkins-ci.main:jenkins-core (MAVEN)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'), CWE-117: Improper Output Neutralization for Logs
Vulnerable versions: >= 2.517, < 2.528
Patched in: 2.528

Summary: Jenkins has a log message injection vulnerability

Details:
In Jenkins 2.527 and earlier, LTS 2.516.2 and earlier, the log formatter that prepares log messages for console output (including `jenkins.log` and equivalent) does not restrict or transform the characters that can be inserted from user-specified content in log messages.

This allows attackers able to control log message contents to insert line break characters, followed by forged log messages that may mislead administrators reviewing log output.

Jenkins 2.528, LTS 2.516.3 adds an indicator at the beginning of a line that was inserted as part of log message content: `[CR]`, `[LF]`, or `[CRLF]` (representing the kind of line break), followed by `>` .
GitHub Security Advisory: GHSA-qrh5-jg98-cr48
Package: org.jenkins-ci.main:jenkins-core (MAVEN)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'), CWE-117: Improper Output Neutralization for Logs
Vulnerable versions: < 2.516.3
Patched in: 2.516.3

Summary: Jenkins has a log message injection vulnerability

Details:
In Jenkins 2.527 and earlier, LTS 2.516.2 and earlier, the log formatter that prepares log messages for console output (including `jenkins.log` and equivalent) does not restrict or transform the characters that can be inserted from user-specified content in log messages.

This allows attackers able to control log message contents to insert line break characters, followed by forged log messages that may mislead administrators reviewing log output.

Jenkins 2.528, LTS 2.516.3 adds an indicator at the beginning of a line that was inserted as part of log message content: `[CR]`, `[LF]`, or `[CRLF]` (representing the kind of line break), followed by `>` .
GitHub Security Advisory: GHSA-223m-4rfp-646h
Package: org.jenkins-ci.main:jenkins-core (MAVEN)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-862: Missing Authorization
Vulnerable versions: >= 2.517, < 2.528
Patched in: 2.528

Summary: Jenkins is missing a permission check in the authenticated users' profile menu 

Details:
Jenkins 2.527 and earlier, LTS 2.516.2 and earlier does not perform a permission check for the authenticated user profile dropdown menu. This allows attackers without Overall/Read permission to obtain limited information about the Jenkins configuration by listing available options in this menu (e.g., whether Credentials Plugin is installed).

Jenkins 2.528, LTS 2.516.3 requires Overall/Read permission to list various items in authenticated user profile dropdown menus.
GitHub Security Advisory: GHSA-223m-4rfp-646h
Package: org.jenkins-ci.main:jenkins-core (MAVEN)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-862: Missing Authorization
Vulnerable versions: < 2.516.3
Patched in: 2.516.3

Summary: Jenkins is missing a permission check in the authenticated users' profile menu 

Details:
Jenkins 2.527 and earlier, LTS 2.516.2 and earlier does not perform a permission check for the authenticated user profile dropdown menu. This allows attackers without Overall/Read permission to obtain limited information about the Jenkins configuration by listing available options in this menu (e.g., whether Credentials Plugin is installed).

Jenkins 2.528, LTS 2.516.3 requires Overall/Read permission to list various items in authenticated user profile dropdown menus.
GitHub Security Advisory: GHSA-67v4-38h7-9jjp
Package: org.jenkins-ci.main:jenkins-core (MAVEN)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-862: Missing Authorization
Vulnerable versions: >= 2.517, < 2.528
Patched in: 2.528

Summary: Jenkins has a missing permission check, allowing users to obtain agent names

Details:
Jenkins 2.527 and earlier, LTS 2.516.2 and earlier does not perform a permission check in the sidepanel of a page intentionally accessible to users lacking Overall/Read permission.

This allows attackers without Overall/Read permission to list agent names through its sidepanel executors widget.

Jenkins 2.528, LTS 2.516.3 removes the sidepanel from the affected view.
GitHub Security Advisory: GHSA-67v4-38h7-9jjp
Package: org.jenkins-ci.main:jenkins-core (MAVEN)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-862: Missing Authorization
Vulnerable versions: < 2.516.3
Patched in: 2.516.3

Summary: Jenkins has a missing permission check, allowing users to obtain agent names

Details:
Jenkins 2.527 and earlier, LTS 2.516.2 and earlier does not perform a permission check in the sidepanel of a page intentionally accessible to users lacking Overall/Read permission.

This allows attackers without Overall/Read permission to list agent names through its sidepanel executors widget.

Jenkins 2.528, LTS 2.516.3 removes the sidepanel from the affected view.
GitHub Security Advisory: GHSA-m4j5-5x4r-2xp9
Package: org.keycloak:keycloak-services (MAVEN)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection')
Vulnerable versions: >= 26.3.0, < 26.3.3
Patched in: 26.3.3

Summary: Keycloak SMTP Inject Vulnerability

Details:
Special characters used during e-mail registration may perform SMTP Injection and unexpectedly send short unwanted e-mails. The email is limited to 64 characters (limited local part of the email), so the attack is limited to very shorts emails (subject and little data, the example is 60 chars). This flaw's only direct consequence is an unsolicited email being sent from the Keycloak server. However, this action could be a precursor for more sophisticated attacks.
GitHub Security Advisory: GHSA-m4j5-5x4r-2xp9
Package: org.keycloak:keycloak-services (MAVEN)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection')
Vulnerable versions: < 26.2.8
Patched in: 26.2.8

Summary: Keycloak SMTP Inject Vulnerability

Details:
Special characters used during e-mail registration may perform SMTP Injection and unexpectedly send short unwanted e-mails. The email is limited to 64 characters (limited local part of the email), so the attack is limited to very shorts emails (subject and little data, the example is 60 chars). This flaw's only direct consequence is an unsolicited email being sent from the Keycloak server. However, this action could be a precursor for more sophisticated attacks.
GitHub Security Advisory: GHSA-5pp7-m8x8-rc82
Package: com.liferay:com.liferay.asset.display.page.service (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-862: Missing Authorization
Vulnerable versions: < 4.0.55
Patched in: 4.0.55

Summary: Liferay Portal allows remote attackers to view display page templates via crafted URLs

Details:
Liferay Portal 7.3.0 through 7.4.3.111, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, and 7.3 GA through update 35 does not perform an authorization check when users attempt to view a display page template, which allows remote attackers to view display page templates via crafted URLs.
GitHub Security Advisory: GHSA-ccrc-5vp5-vp5j
Package: com.liferay:com.liferay.portal.search (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 8.0.93
Patched in: 8.0.93

Summary: Liferay search widget vulnerable to Cross-site Scripting

Details:
There is a Cross-site scripting (XSS) vulnerability in Liferay Portal's Search widget . Versions 7.4.3.93 through 7.4.3.111, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4 allow remote attackers to inject arbitrary web scripts or HTML via the `_com_liferay_portal_search_web_portlet_SearchPortlet_userId` parameter.