{"id":"CVE-2019-6588","details":"In Liferay Portal before 7.1 CE GA4, an XSS vulnerability exists in the SimpleCaptcha API when custom code passes unsanitized input into the \"url\" parameter of the JSP taglib call \u003cliferay-ui:captcha url=\"\u003c%= url %\u003e\" /\u003e or \u003cliferay-captcha:captcha url=\"\u003c%= url %\u003e\" /\u003e. Liferay Portal out-of-the-box behavior with no customizations is not vulnerable.","aliases":["GHSA-hwp2-gvm5-452f"],"modified":"2026-09-05T03:30:43.955333384Z","published":"2019-06-03T20:29:01.547Z","database_specific":{"unresolved_ranges":[{"cpes":["cpe:2.3:a:liferay:liferay_portal:*:*:*:*:community:*:*:*"],"extracted_events":[{"last_affected":"6.0.6"}],"source":"CPE_RANGE","vendor_product":"liferay:liferay_portal"}]},"references":[{"type":"WEB","url":"http://packetstormsecurity.com/files/153252/Liferay-Portal-7.1-CE-GA4-Cross-Site-Scripting.html"},{"type":"ADVISORY","url":"https://dev.liferay.com/web/community-security-team/known-vulnerabilities/liferay-portal-71/-/asset_publisher/7v4O7y85hZMo/content/cst-7130-multiple-xss-vulnerabilities-in-7-1-ce-ga3"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/liferay/liferay-portal","events":[{"introduced":"73c2fa07b6d1ce2d0b52d290fda7c859ed3ec5d9"},{"last_affected":"439f94cc22eea87c56abb3405b6f8e3ba705dacb"}],"database_specific":{"cpe":["cpe:2.3:a:liferay:liferay_portal:6.1.0:b1:*:*:community:*:*:*","cpe:2.3:a:liferay:liferay_portal:6.1.0:ga1:*:*:community:*:*:*","cpe:2.3:a:liferay:liferay_portal:6.1.0:b2:*:*:community:*:*:*","cpe:2.3:a:liferay:liferay_portal:6.1.0:b3:*:*:community:*:*:*","cpe:2.3:a:liferay:liferay_portal:6.1.0:b4:*:*:community:*:*:*","cpe:2.3:a:liferay:liferay_portal:6.1.0:rc1:*:*:community:*:*:*","cpe:2.3:a:liferay:liferay_portal:6.1.1:ga2:*:*:community:*:*:*","cpe:2.3:a:liferay:liferay_portal:6.1.2:ga3:*:*:community:*:*:*","cpe:2.3:a:liferay:liferay_portal:6.2.0:b1:*:*:community:*:*:*","cpe:2.3:a:liferay:liferay_portal:6.2.0:ga1:*:*:community:*:*:*","cpe:2.3:a:liferay:liferay_portal:6.2.0:m1:*:*:community:*:*:*","cpe:2.3:a:liferay:liferay_portal:6.2.0:b2:*:*:community:*:*:*","cpe:2.3:a:liferay:liferay_portal:6.2.0:m2:*:*:community:*:*:*","cpe:2.3:a:liferay:liferay_portal:6.2.0:m3:*:*:community:*:*:*","cpe:2.3:a:liferay:liferay_portal:6.2.0:m4:*:*:community:*:*:*","cpe:2.3:a:liferay:liferay_portal:6.2.0:m5:*:*:community:*:*:*","cpe:2.3:a:liferay:liferay_portal:6.2.0:m6:*:*:community:*:*:*","cpe:2.3:a:liferay:liferay_portal:6.2.0:rc1:*:*:community:*:*:*","cpe:2.3:a:liferay:liferay_portal:6.2.0:rc2:*:*:community:*:*:*","cpe:2.3:a:liferay:liferay_portal:6.2.0:rc3:*:*:community:*:*:*","cpe:2.3:a:liferay:liferay_portal:6.2.0:rc4:*:*:community:*:*:*","cpe:2.3:a:liferay:liferay_portal:6.2.0:rc5:*:*:community:*:*:*","cpe:2.3:a:liferay:liferay_portal:6.2.0:rc6:*:*:community:*:*:*","cpe:2.3:a:liferay:liferay_portal:6.2.1:ga2:*:*:community:*:*:*","cpe:2.3:a:liferay:liferay_portal:6.2.2:ga3:*:*:community:*:*:*","cpe:2.3:a:liferay:liferay_portal:6.2.3:ga4:*:*:community:*:*:*","cpe:2.3:a:liferay:liferay_portal:6.2.4:ga5:*:*:community:*:*:*","cpe:2.3:a:liferay:liferay_portal:6.2.5:ga6:*:*:community:*:*:*","cpe:2.3:a:liferay:liferay_portal:7.0.0:a1:*:*:community:*:*:*","cpe:2.3:a:liferay:liferay_portal:7.0.0:b1:*:*:community:*:*:*","cpe:2.3:a:liferay:liferay_portal:7.0.0:ga1:*:*:community:*:*:*","cpe:2.3:a:liferay:liferay_portal:7.0.0:m1:*:*:community:*:*:*","cpe:2.3:a:liferay:liferay_portal:7.0.0:a2:*:*:community:*:*:*","cpe:2.3:a:liferay:liferay_portal:7.0.0:b2:*:*:community:*:*:*","cpe:2.3:a:liferay:liferay_portal:7.0.0:m2:*:*:community:*:*:*","cpe:2.3:a:liferay:liferay_portal:7.0.0:a3:*:*:community:*:*:*","cpe:2.3:a:liferay:liferay_portal:7.0.0:b3:*:*:community:*:*:*","cpe:2.3:a:liferay:liferay_portal:7.0.0:m3:*:*:community:*:*:*","cpe:2.3:a:liferay:liferay_portal:7.0.0:a4:*:*:community:*:*:*","cpe:2.3:a:liferay:liferay_portal:7.0.0:b4:*:*:community:*:*:*","cpe:2.3:a:liferay:liferay_portal:7.0.0:m4:*:*:community:*:*:*","cpe:2.3:a:liferay:liferay_portal:7.0.0:a5:*:*:community:*:*:*","cpe:2.3:a:liferay:liferay_portal:7.0.0:b5:*:*:community:*:*:*","cpe:2.3:a:liferay:liferay_portal:7.0.0:m5:*:*:community:*:*:*","cpe:2.3:a:liferay:liferay_portal:7.0.0:b6:*:*:community:*:*:*","cpe:2.3:a:liferay:liferay_portal:7.0.0:m6:*:*:community:*:*:*","cpe:2.3:a:liferay:liferay_portal:7.0.0:b7:*:*:community:*:*:*","cpe:2.3:a:liferay:liferay_portal:7.0.0:m7:*:*:community:*:*:*","cpe:2.3:a:liferay:liferay_portal:7.0.1:ga2:*:*:community:*:*:*","cpe:2.3:a:liferay:liferay_portal:7.0.2:ga3:*:*:community:*:*:*","cpe:2.3:a:liferay:liferay_portal:7.0.3:ga4:*:*:community:*:*:*","cpe:2.3:a:liferay:liferay_portal:7.0.4:ga5:*:*:community:*:*:*","cpe:2.3:a:liferay:liferay_portal:7.0.5:ga6:*:*:community:*:*:*","cpe:2.3:a:liferay:liferay_portal:7.0.6:ga7:*:*:community:*:*:*","cpe:2.3:a:liferay:liferay_portal:7.1.0:a1:*:*:community:*:*:*","cpe:2.3:a:liferay:liferay_portal:7.1.0:b1:*:*:community:*:*:*","cpe:2.3:a:liferay:liferay_portal:7.1.0:ga1:*:*:community:*:*:*","cpe:2.3:a:liferay:liferay_portal:7.1.0:m1:*:*:community:*:*:*","cpe:2.3:a:liferay:liferay_portal:7.1.0:a2:*:*:community:*:*:*","cpe:2.3:a:liferay:liferay_portal:7.1.0:b2:*:*:community:*:*:*","cpe:2.3:a:liferay:liferay_portal:7.1.0:m2:*:*:community:*:*:*","cpe:2.3:a:liferay:liferay_portal:7.1.0:b3:*:*:community:*:*:*","cpe:2.3:a:liferay:liferay_portal:7.1.0:rc1:*:*:community:*:*:*"],"extracted_events":[{"introduced":"6.1.0-b1"},{"last_affected":"6.1.0-b1"},{"introduced":"6.1.0-ga1"},{"last_affected":"6.1.0-ga1"},{"introduced":"6.1.0-b2"},{"last_affected":"6.1.0-b2"},{"introduced":"6.1.0-b3"},{"last_affected":"6.1.0-b3"},{"introduced":"6.1.0-b4"},{"last_affected":"6.1.0-b4"},{"introduced":"6.1.0-rc1"},{"last_affected":"6.1.0-rc1"},{"introduced":"6.1.1-ga2"},{"last_affected":"6.1.1-ga2"},{"introduced":"6.1.2-ga3"},{"last_affected":"6.1.2-ga3"},{"introduced":"6.2.0-b1"},{"last_affected":"6.2.0-b1"},{"introduced":"6.2.0-ga1"},{"last_affected":"6.2.0-ga1"},{"introduced":"6.2.0-m1"},{"last_affected":"6.2.0-m1"},{"introduced":"6.2.0-b2"},{"last_affected":"6.2.0-b2"},{"introduced":"6.2.0-m2"},{"last_affected":"6.2.0-m2"},{"introduced":"6.2.0-m3"},{"last_affected":"6.2.0-m3"},{"introduced":"6.2.0-m4"},{"last_affected":"6.2.0-m4"},{"introduced":"6.2.0-m5"},{"last_affected":"6.2.0-m5"},{"introduced":"6.2.0-m6"},{"last_affected":"6.2.0-m6"},{"introduced":"6.2.0-rc1"},{"last_affected":"6.2.0-rc1"},{"introduced":"6.2.0-rc2"},{"last_affected":"6.2.0-rc2"},{"introduced":"6.2.0-rc3"},{"last_affected":"6.2.0-rc3"},{"introduced":"6.2.0-rc4"},{"last_affected":"6.2.0-rc4"},{"introduced":"6.2.0-rc5"},{"last_affected":"6.2.0-rc5"},{"introduced":"6.2.0-rc6"},{"last_affected":"6.2.0-rc6"},{"introduced":"6.2.1-ga2"},{"last_affected":"6.2.1-ga2"},{"introduced":"6.2.2-ga3"},{"last_affected":"6.2.2-ga3"},{"introduced":"6.2.3-ga4"},{"last_affected":"6.2.3-ga4"},{"introduced":"6.2.4-ga5"},{"last_affected":"6.2.4-ga5"},{"introduced":"6.2.5-ga6"},{"last_affected":"6.2.5-ga6"},{"introduced":"7.0.0-a1"},{"last_affected":"7.0.0-a1"},{"introduced":"7.0.0-b1"},{"last_affected":"7.0.0-b1"},{"introduced":"7.0.0-ga1"},{"last_affected":"7.0.0-ga1"},{"introduced":"7.0.0-m1"},{"last_affected":"7.0.0-m1"},{"introduced":"7.0.0-a2"},{"last_affected":"7.0.0-a2"},{"introduced":"7.0.0-b2"},{"last_affected":"7.0.0-b2"},{"introduced":"7.0.0-m2"},{"last_affected":"7.0.0-m2"},{"introduced":"7.0.0-a3"},{"last_affected":"7.0.0-a3"},{"introduced":"7.0.0-b3"},{"last_affected":"7.0.0-b3"},{"introduced":"7.0.0-m3"},{"last_affected":"7.0.0-m3"},{"introduced":"7.0.0-a4"},{"last_affected":"7.0.0-a4"},{"introduced":"7.0.0-b4"},{"last_affected":"7.0.0-b4"},{"introduced":"7.0.0-m4"},{"last_affected":"7.0.0-m4"},{"introduced":"7.0.0-a5"},{"last_affected":"7.0.0-a5"},{"introduced":"7.0.0-b5"},{"last_affected":"7.0.0-b5"},{"introduced":"7.0.0-m5"},{"last_affected":"7.0.0-m5"},{"introduced":"7.0.0-b6"},{"last_affected":"7.0.0-b6"},{"introduced":"7.0.0-m6"},{"last_affected":"7.0.0-m6"},{"introduced":"7.0.0-b7"},{"last_affected":"7.0.0-b7"},{"introduced":"7.0.0-m7"},{"last_affected":"7.0.0-m7"},{"introduced":"7.0.1-ga2"},{"last_affected":"7.0.1-ga2"},{"introduced":"7.0.2-ga3"},{"last_affected":"7.0.2-ga3"},{"introduced":"7.0.3-ga4"},{"last_affected":"7.0.3-ga4"},{"introduced":"7.0.4-ga5"},{"last_affected":"7.0.4-ga5"},{"introduced":"7.0.5-ga6"},{"last_affected":"7.0.5-ga6"},{"introduced":"7.0.6-ga7"},{"last_affected":"7.0.6-ga7"},{"introduced":"7.1.0-a1"},{"last_affected":"7.1.0-a1"},{"introduced":"7.1.0-b1"},{"last_affected":"7.1.0-b1"},{"introduced":"7.1.0-ga1"},{"last_affected":"7.1.0-ga1"},{"introduced":"7.1.0-m1"},{"last_affected":"7.1.0-m1"},{"introduced":"7.1.0-a2"},{"last_affected":"7.1.0-a2"},{"introduced":"7.1.0-b2"},{"last_affected":"7.1.0-b2"},{"introduced":"7.1.0-m2"},{"last_affected":"7.1.0-m2"},{"introduced":"7.1.0-b3"},{"last_affected":"7.1.0-b3"},{"introduced":"7.1.0-rc1"},{"last_affected":"7.1.0-rc1"}],"source":"CPE_STRING"}}],"versions":["6.1.0-b1","6.1.0-b2","6.1.0-b3","6.1.0-b4","6.1.0-rc1","6.1.1-ga2","6.1.2-ga3","6.2.0-b1","6.2.0-b2","6.2.0-m3","6.2.0-m4","6.2.0-m5","6.2.0-m6","6.2.0-rc1","6.2.0-rc2","6.2.0-rc3","6.2.0-rc4","6.2.0-rc5","6.2.0-rc6","6.2.1-ga2","6.2.2-ga3","6.2.3-ga4","6.2.4-ga5","6.2.5-ga6","7.0.0-a1","7.0.0-a2","7.0.0-a3","7.0.0-a4","7.0.0-a5","7.0.0-b6","7.0.0-b7","7.0.1-ga2","7.0.2-ga3","7.0.3-ga4","7.0.4-ga5","7.0.5-ga6","7.0.6-ga7","7.1.0-a1","7.1.0-a2","7.1.0-b3","7.1.0-rc1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-6588.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N"}]}