WaratekVRT Sign in

CVE-2019-6588 Liferay Portal

Affected softwareLiferay Portal
Severity4.7 Medium CVSS 3.0 2 scores
Fixed in7.1.0
WeaknessCross-site scripting (CWE-79)
Published3 Jun 2019
Updated17 Jun 2026

Description

In Liferay Portal before 7.1 CE GA4, an XSS vulnerability exists in the SimpleCaptcha API when custom code passes unsanitized input into the "url" parameter of the JSP taglib call <liferay-ui:captcha url="<%= url %>" /> or <liferay-captcha:captcha url="<%= url %>" />. Liferay Portal out-of-the-box behavior with no customizations is not vulnerable.

Exploitation status

Working exploit published

A reviewed exploit catalogue lists ready-to-run exploit code for this CVE.
  • CISA KEV not listed
  • VulnCheck KEV not listed
  • CISA Vulnrichment no assessment published
  • Indexed PoC 1 indexed Published artifacts you can open, in Exploit-DB; first seen 2019-06-11.
  • EPSS 2.3% chance in 30 days
IndexArtifactStarsFirst seen
Exploit-DB Liferay Portal 7.1 CE GA=3 / SimpleCaptcha API - Cross-Site Scripting 2019-06-11

Waratek protection

Mitigation candidate

A kind of vulnerability Waratek's rules address, with exploit code published or exploitation reported. No rule exists and none is planned yet. The decision below says what we found to build a rule from.

  • Protection none
  • Action unverified
  • Review automated Inferred
  • Record active
Decided by The affected package being open source on Maven, so the fix can be read
Finding This CVE affects an open-source Java library published on Maven Central (Maven packages: com.liferay.portal:release.portal.bom), so it is squarely in ARMR's territory and the source needed to understand the defect is public. That makes it a candidate for an ARMR patch rule. No rule exists and none is scheduled: the diff between the affected and fixed versions has not been read, and a closer look may find no hook point ARMR can act on.

CVSS

4.7 MEDIUM v3.0 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N 2 metrics

We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.

VersionScoreBandVectorAssignerType
CVSS 3.0 4.7 MEDIUM CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N NVD Primary published
CVSS 2.0 2.6 none AV:N/AC:H/Au:N/C:N/I:P/A:N NVD Primary

Affected software and releases

Maven packages

Affected and fixed versions, from OSV.dev
PackageIntroducedFixedLast affected
com.liferay.portal:release.portal.bom 0 7.1.0 unbounded

Products and versions

2 products, 65 version entries
SourceVendorProductSchemeAffected versions
osv com.liferay.portal release.portal.bom generic ＜ 7.1.0
nvd liferay liferay portal generic ≤ 6.0.6 · 6.1.0:rc1 · 6.1.0:b1 · 6.1.0:ga1 · 6.1.0:b2 · 6.1.0:b3 · 6.1.0:b4 · 6.1.1:ga2 · 6.1.2:ga3 · 6.2.0:m1 · 6.2.0:m2 · 6.2.0:m3 · 6.2.0:m4 · 6.2.0:m5 · 6.2.0:m6 · 6.2.0:rc1 · 6.2.0:rc2 · 6.2.0:rc3 · 6.2.0:rc4 · 6.2.0:rc5 · 6.2.0:rc6 · 6.2.0:b1 · 6.2.0:ga1 · 6.2.0:b2 · 6.2.1:ga2 · 6.2.2:ga3 · 6.2.3:ga4 · 6.2.4:ga5 · 6.2.5:ga6 · 7.0.0:m1 · 7.0.0:m2 · 7.0.0:m3 · 7.0.0:m4 · 7.0.0:m5 · 7.0.0:m6 · 7.0.0:m7 · 7.0.0:a1 · 7.0.0:b1 · 7.0.0:ga1 · 7.0.0:a2 · 7.0.0:b2 · 7.0.0:a3 · 7.0.0:b3 · 7.0.0:a4 · 7.0.0:b4 · 7.0.0:a5 · 7.0.0:b5 · 7.0.0:b6 · 7.0.0:b7 · 7.0.1:ga2 · 7.0.2:ga3 · 7.0.3:ga4 · 7.0.4:ga5 · 7.0.5:ga6 · 7.0.6:ga7 · 7.1.0:m1 · 7.1.0:m2 · 7.1.0:rc1 · 7.1.0:a1 · 7.1.0:b1 · 7.1.0:ga1 · 7.1.0:a2 · 7.1.0:b2 · 7.1.0:b3

References

URLTags
https://dev.liferay.com/web/community-security-team/known-vulnerabilities/liferay-portal-71/-/asset_publisher/7v4O7y85hZMo/content/cst-7130-multiple-xss-vulnerabilities-in-7-1-ce-ga3 WEB
https://github.com/liferay/liferay-portal PACKAGE
http://packetstormsecurity.com/files/153252/Liferay-Portal-7.1-CE-GA4-Cross-Site-Scripting.html WEB

Timeline
Published2019-06-03By the CVE Program.
NVD record modified2026-06-17NVD's own last-modified date for this record.