Read the docs
TI-2019-04638 Aliases CVE-2019-6588GHSA-hwp2-gvm5-452f

In Liferay Portal before 7.1 CE GA4, an XSS vulnerability exists in the SimpleCaptcha API…

Priority LOW 26CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
High
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

In Liferay Portal before 7.1 CE GA4, an XSS vulnerability exists in the SimpleCaptcha API when custom code passes unsanitized input into the "url" parameter of the JSP taglib call <liferay-ui:captcha url="<%= url %>" /> or <liferay-captcha:captcha url="<%= url %>" />. Liferay Portal out-of-the-box behavior with no customizations is not vulnerable.

Why it matters now

EPSS 0.02302 83rd percentileScored 2026-11-07
Fix Fixed com.liferay.portal:release.portal.bom (Maven): 7.1.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—com.liferay.portal:release.portal.bom (Maven)before 7.1.07.1.0Patch availableGHSA-hwp2-gvm5-452f
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • com.liferay.portal:release.portal.bom (Maven) Vendor— Affected before 7.1.0 Fixed in 7.1.0 Patch available GHSA-hwp2-gvm5-452f

CPE configurations NVD · 64

CPEVersionsRoleVendor
cpe:2.3:a:liferay:liferay_portal:*:*:*:*:community:*:*:*up to 6.0.6VulnerableLiferay
cpe:2.3:a:liferay:liferay_portal:6.1.0:b1:*:*:community:*:*:*6.1.0 b1VulnerableLiferay
cpe:2.3:a:liferay:liferay_portal:6.1.0:b2:*:*:community:*:*:*6.1.0 b2VulnerableLiferay
cpe:2.3:a:liferay:liferay_portal:6.1.0:b3:*:*:community:*:*:*6.1.0 b3VulnerableLiferay
cpe:2.3:a:liferay:liferay_portal:6.1.0:b4:*:*:community:*:*:*6.1.0 b4VulnerableLiferay
cpe:2.3:a:liferay:liferay_portal:6.1.0:ga1:*:*:community:*:*:*6.1.0 ga1VulnerableLiferay
cpe:2.3:a:liferay:liferay_portal:6.1.0:rc1:*:*:community:*:*:*6.1.0 rc1VulnerableLiferay
cpe:2.3:a:liferay:liferay_portal:6.1.1:ga2:*:*:community:*:*:*6.1.1 ga2VulnerableLiferay
cpe:2.3:a:liferay:liferay_portal:6.1.2:ga3:*:*:community:*:*:*6.1.2 ga3VulnerableLiferay
cpe:2.3:a:liferay:liferay_portal:6.2.0:b1:*:*:community:*:*:*6.2.0 b1VulnerableLiferay
  • cpe:2.3:a:liferay:liferay_portal:*:*:*:*:community:*:*:* Versions up to 6.0.6 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:liferay_portal:6.1.0:b1:*:*:community:*:*:* Versions 6.1.0 b1 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:liferay_portal:6.1.0:b2:*:*:community:*:*:* Versions 6.1.0 b2 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:liferay_portal:6.1.0:b3:*:*:community:*:*:* Versions 6.1.0 b3 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:liferay_portal:6.1.0:b4:*:*:community:*:*:* Versions 6.1.0 b4 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:liferay_portal:6.1.0:ga1:*:*:community:*:*:* Versions 6.1.0 ga1 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:liferay_portal:6.1.0:rc1:*:*:community:*:*:* Versions 6.1.0 rc1 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:liferay_portal:6.1.1:ga2:*:*:community:*:*:* Versions 6.1.1 ga2 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:liferay_portal:6.1.2:ga3:*:*:community:*:*:* Versions 6.1.2 ga3 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:liferay_portal:6.2.0:b1:*:*:community:*:*:* Versions 6.2.0 b1 Vulnerable ·Liferay
Show 54 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:liferay:liferay_portal:6.2.0:b2:*:*:community:*:*:*6.2.0 b2VulnerableLiferay
cpe:2.3:a:liferay:liferay_portal:6.2.0:ga1:*:*:community:*:*:*6.2.0 ga1VulnerableLiferay
cpe:2.3:a:liferay:liferay_portal:6.2.0:m1:*:*:community:*:*:*6.2.0 m1VulnerableLiferay
cpe:2.3:a:liferay:liferay_portal:6.2.0:m2:*:*:community:*:*:*6.2.0 m2VulnerableLiferay
cpe:2.3:a:liferay:liferay_portal:6.2.0:m3:*:*:community:*:*:*6.2.0 m3VulnerableLiferay
cpe:2.3:a:liferay:liferay_portal:6.2.0:m4:*:*:community:*:*:*6.2.0 m4VulnerableLiferay
cpe:2.3:a:liferay:liferay_portal:6.2.0:m5:*:*:community:*:*:*6.2.0 m5VulnerableLiferay
cpe:2.3:a:liferay:liferay_portal:6.2.0:m6:*:*:community:*:*:*6.2.0 m6VulnerableLiferay
cpe:2.3:a:liferay:liferay_portal:6.2.0:rc1:*:*:community:*:*:*6.2.0 rc1VulnerableLiferay
cpe:2.3:a:liferay:liferay_portal:6.2.0:rc2:*:*:community:*:*:*6.2.0 rc2VulnerableLiferay
cpe:2.3:a:liferay:liferay_portal:6.2.0:rc3:*:*:community:*:*:*6.2.0 rc3VulnerableLiferay
cpe:2.3:a:liferay:liferay_portal:6.2.0:rc4:*:*:community:*:*:*6.2.0 rc4VulnerableLiferay
cpe:2.3:a:liferay:liferay_portal:6.2.0:rc5:*:*:community:*:*:*6.2.0 rc5VulnerableLiferay
cpe:2.3:a:liferay:liferay_portal:6.2.0:rc6:*:*:community:*:*:*6.2.0 rc6VulnerableLiferay
cpe:2.3:a:liferay:liferay_portal:6.2.1:ga2:*:*:community:*:*:*6.2.1 ga2VulnerableLiferay
cpe:2.3:a:liferay:liferay_portal:6.2.2:ga3:*:*:community:*:*:*6.2.2 ga3VulnerableLiferay
cpe:2.3:a:liferay:liferay_portal:6.2.3:ga4:*:*:community:*:*:*6.2.3 ga4VulnerableLiferay
cpe:2.3:a:liferay:liferay_portal:6.2.4:ga5:*:*:community:*:*:*6.2.4 ga5VulnerableLiferay
cpe:2.3:a:liferay:liferay_portal:6.2.5:ga6:*:*:community:*:*:*6.2.5 ga6VulnerableLiferay
cpe:2.3:a:liferay:liferay_portal:7.0.0:a1:*:*:community:*:*:*7.0.0 a1VulnerableLiferay
cpe:2.3:a:liferay:liferay_portal:7.0.0:a2:*:*:community:*:*:*7.0.0 a2VulnerableLiferay
cpe:2.3:a:liferay:liferay_portal:7.0.0:a3:*:*:community:*:*:*7.0.0 a3VulnerableLiferay
cpe:2.3:a:liferay:liferay_portal:7.0.0:a4:*:*:community:*:*:*7.0.0 a4VulnerableLiferay
cpe:2.3:a:liferay:liferay_portal:7.0.0:a5:*:*:community:*:*:*7.0.0 a5VulnerableLiferay
cpe:2.3:a:liferay:liferay_portal:7.0.0:b1:*:*:community:*:*:*7.0.0 b1VulnerableLiferay
cpe:2.3:a:liferay:liferay_portal:7.0.0:b2:*:*:community:*:*:*7.0.0 b2VulnerableLiferay
cpe:2.3:a:liferay:liferay_portal:7.0.0:b3:*:*:community:*:*:*7.0.0 b3VulnerableLiferay
cpe:2.3:a:liferay:liferay_portal:7.0.0:b4:*:*:community:*:*:*7.0.0 b4VulnerableLiferay
cpe:2.3:a:liferay:liferay_portal:7.0.0:b5:*:*:community:*:*:*7.0.0 b5VulnerableLiferay
cpe:2.3:a:liferay:liferay_portal:7.0.0:b6:*:*:community:*:*:*7.0.0 b6VulnerableLiferay
cpe:2.3:a:liferay:liferay_portal:7.0.0:b7:*:*:community:*:*:*7.0.0 b7VulnerableLiferay
cpe:2.3:a:liferay:liferay_portal:7.0.0:ga1:*:*:community:*:*:*7.0.0 ga1VulnerableLiferay
cpe:2.3:a:liferay:liferay_portal:7.0.0:m1:*:*:community:*:*:*7.0.0 m1VulnerableLiferay
cpe:2.3:a:liferay:liferay_portal:7.0.0:m2:*:*:community:*:*:*7.0.0 m2VulnerableLiferay
cpe:2.3:a:liferay:liferay_portal:7.0.0:m3:*:*:community:*:*:*7.0.0 m3VulnerableLiferay
cpe:2.3:a:liferay:liferay_portal:7.0.0:m4:*:*:community:*:*:*7.0.0 m4VulnerableLiferay
cpe:2.3:a:liferay:liferay_portal:7.0.0:m5:*:*:community:*:*:*7.0.0 m5VulnerableLiferay
cpe:2.3:a:liferay:liferay_portal:7.0.0:m6:*:*:community:*:*:*7.0.0 m6VulnerableLiferay
cpe:2.3:a:liferay:liferay_portal:7.0.0:m7:*:*:community:*:*:*7.0.0 m7VulnerableLiferay
cpe:2.3:a:liferay:liferay_portal:7.0.1:ga2:*:*:community:*:*:*7.0.1 ga2VulnerableLiferay
cpe:2.3:a:liferay:liferay_portal:7.0.2:ga3:*:*:community:*:*:*7.0.2 ga3VulnerableLiferay
cpe:2.3:a:liferay:liferay_portal:7.0.3:ga4:*:*:community:*:*:*7.0.3 ga4VulnerableLiferay
cpe:2.3:a:liferay:liferay_portal:7.0.4:ga5:*:*:community:*:*:*7.0.4 ga5VulnerableLiferay
cpe:2.3:a:liferay:liferay_portal:7.0.5:ga6:*:*:community:*:*:*7.0.5 ga6VulnerableLiferay
cpe:2.3:a:liferay:liferay_portal:7.0.6:ga7:*:*:community:*:*:*7.0.6 ga7VulnerableLiferay
cpe:2.3:a:liferay:liferay_portal:7.1.0:a1:*:*:community:*:*:*7.1.0 a1VulnerableLiferay
cpe:2.3:a:liferay:liferay_portal:7.1.0:a2:*:*:community:*:*:*7.1.0 a2VulnerableLiferay
cpe:2.3:a:liferay:liferay_portal:7.1.0:b1:*:*:community:*:*:*7.1.0 b1VulnerableLiferay
cpe:2.3:a:liferay:liferay_portal:7.1.0:b2:*:*:community:*:*:*7.1.0 b2VulnerableLiferay
cpe:2.3:a:liferay:liferay_portal:7.1.0:b3:*:*:community:*:*:*7.1.0 b3VulnerableLiferay
cpe:2.3:a:liferay:liferay_portal:7.1.0:ga1:*:*:community:*:*:*7.1.0 ga1VulnerableLiferay
cpe:2.3:a:liferay:liferay_portal:7.1.0:m1:*:*:community:*:*:*7.1.0 m1VulnerableLiferay
cpe:2.3:a:liferay:liferay_portal:7.1.0:m2:*:*:community:*:*:*7.1.0 m2VulnerableLiferay
cpe:2.3:a:liferay:liferay_portal:7.1.0:rc1:*:*:community:*:*:*7.1.0 rc1VulnerableLiferay
  • cpe:2.3:a:liferay:liferay_portal:6.2.0:b2:*:*:community:*:*:* Versions 6.2.0 b2 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:liferay_portal:6.2.0:ga1:*:*:community:*:*:* Versions 6.2.0 ga1 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:liferay_portal:6.2.0:m1:*:*:community:*:*:* Versions 6.2.0 m1 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:liferay_portal:6.2.0:m2:*:*:community:*:*:* Versions 6.2.0 m2 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:liferay_portal:6.2.0:m3:*:*:community:*:*:* Versions 6.2.0 m3 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:liferay_portal:6.2.0:m4:*:*:community:*:*:* Versions 6.2.0 m4 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:liferay_portal:6.2.0:m5:*:*:community:*:*:* Versions 6.2.0 m5 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:liferay_portal:6.2.0:m6:*:*:community:*:*:* Versions 6.2.0 m6 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:liferay_portal:6.2.0:rc1:*:*:community:*:*:* Versions 6.2.0 rc1 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:liferay_portal:6.2.0:rc2:*:*:community:*:*:* Versions 6.2.0 rc2 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:liferay_portal:6.2.0:rc3:*:*:community:*:*:* Versions 6.2.0 rc3 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:liferay_portal:6.2.0:rc4:*:*:community:*:*:* Versions 6.2.0 rc4 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:liferay_portal:6.2.0:rc5:*:*:community:*:*:* Versions 6.2.0 rc5 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:liferay_portal:6.2.0:rc6:*:*:community:*:*:* Versions 6.2.0 rc6 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:liferay_portal:6.2.1:ga2:*:*:community:*:*:* Versions 6.2.1 ga2 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:liferay_portal:6.2.2:ga3:*:*:community:*:*:* Versions 6.2.2 ga3 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:liferay_portal:6.2.3:ga4:*:*:community:*:*:* Versions 6.2.3 ga4 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:liferay_portal:6.2.4:ga5:*:*:community:*:*:* Versions 6.2.4 ga5 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:liferay_portal:6.2.5:ga6:*:*:community:*:*:* Versions 6.2.5 ga6 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:liferay_portal:7.0.0:a1:*:*:community:*:*:* Versions 7.0.0 a1 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:liferay_portal:7.0.0:a2:*:*:community:*:*:* Versions 7.0.0 a2 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:liferay_portal:7.0.0:a3:*:*:community:*:*:* Versions 7.0.0 a3 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:liferay_portal:7.0.0:a4:*:*:community:*:*:* Versions 7.0.0 a4 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:liferay_portal:7.0.0:a5:*:*:community:*:*:* Versions 7.0.0 a5 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:liferay_portal:7.0.0:b1:*:*:community:*:*:* Versions 7.0.0 b1 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:liferay_portal:7.0.0:b2:*:*:community:*:*:* Versions 7.0.0 b2 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:liferay_portal:7.0.0:b3:*:*:community:*:*:* Versions 7.0.0 b3 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:liferay_portal:7.0.0:b4:*:*:community:*:*:* Versions 7.0.0 b4 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:liferay_portal:7.0.0:b5:*:*:community:*:*:* Versions 7.0.0 b5 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:liferay_portal:7.0.0:b6:*:*:community:*:*:* Versions 7.0.0 b6 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:liferay_portal:7.0.0:b7:*:*:community:*:*:* Versions 7.0.0 b7 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:liferay_portal:7.0.0:ga1:*:*:community:*:*:* Versions 7.0.0 ga1 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:liferay_portal:7.0.0:m1:*:*:community:*:*:* Versions 7.0.0 m1 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:liferay_portal:7.0.0:m2:*:*:community:*:*:* Versions 7.0.0 m2 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:liferay_portal:7.0.0:m3:*:*:community:*:*:* Versions 7.0.0 m3 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:liferay_portal:7.0.0:m4:*:*:community:*:*:* Versions 7.0.0 m4 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:liferay_portal:7.0.0:m5:*:*:community:*:*:* Versions 7.0.0 m5 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:liferay_portal:7.0.0:m6:*:*:community:*:*:* Versions 7.0.0 m6 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:liferay_portal:7.0.0:m7:*:*:community:*:*:* Versions 7.0.0 m7 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:liferay_portal:7.0.1:ga2:*:*:community:*:*:* Versions 7.0.1 ga2 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:liferay_portal:7.0.2:ga3:*:*:community:*:*:* Versions 7.0.2 ga3 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:liferay_portal:7.0.3:ga4:*:*:community:*:*:* Versions 7.0.3 ga4 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:liferay_portal:7.0.4:ga5:*:*:community:*:*:* Versions 7.0.4 ga5 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:liferay_portal:7.0.5:ga6:*:*:community:*:*:* Versions 7.0.5 ga6 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:liferay_portal:7.0.6:ga7:*:*:community:*:*:* Versions 7.0.6 ga7 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:liferay_portal:7.1.0:a1:*:*:community:*:*:* Versions 7.1.0 a1 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:liferay_portal:7.1.0:a2:*:*:community:*:*:* Versions 7.1.0 a2 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:liferay_portal:7.1.0:b1:*:*:community:*:*:* Versions 7.1.0 b1 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:liferay_portal:7.1.0:b2:*:*:community:*:*:* Versions 7.1.0 b2 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:liferay_portal:7.1.0:b3:*:*:community:*:*:* Versions 7.1.0 b3 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:liferay_portal:7.1.0:ga1:*:*:community:*:*:* Versions 7.1.0 ga1 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:liferay_portal:7.1.0:m1:*:*:community:*:*:* Versions 7.1.0 m1 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:liferay_portal:7.1.0:m2:*:*:community:*:*:* Versions 7.1.0 m2 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:liferay_portal:7.1.0:rc1:*:*:community:*:*:* Versions 7.1.0 rc1 Vulnerable ·Liferay

Remediation

  • Fix · GHSA-hwp2-gvm5-452f com.liferay.portal:release.portal.bom (Maven) Fixed in 7.1.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-6588
  2. 2026-10-03 Alias added: GHSA-hwp2-gvm5-452f

References

Advisory 2

Other 2

  • TI-2020-06440 Deserialization of Untrusted Data in Liferay Portal prior to 7.2.1 CE GA2 allows remote… KEVCVSS 3.1CRITICAL 9.8
  • TI-2019-12596 Liferay Portal CE 6.2.5 allows remote command execution because of deserialization of a JSON payload. CVSS 3.1CRITICAL 9.8
  • TI-2021-13252 Liferay Portal 6.2.5 allows Command=FileUpload&Type=File&CurrentFolder=/ requests when… CVSS 3.1CRITICAL 9.8
  • TI-2022-18349 A Cross-site scripting (XSS) vulnerability in the Blog module - add new topic… CVSS 3.1MEDIUM 5.4
  • TI-2022-18348 A Cross-site scripting (XSS) vulnerability in the Document and Media module - file upload… CVSS 3.1MEDIUM 5.4
  • TI-2022-20404 A SQL injection vulnerability in the Friendly Url module in Liferay Portal 7.3.7, and… CVSS 3.1CRITICAL 9.8
See all 318 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences