{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-05-02T02:35:22.910","vulnerabilities":[{"cve":{"id":"CVE-2020-25476","sourceIdentifier":"cve@mitre.org","published":"2021-01-07T17:15:12.590","lastModified":"2024-11-21T05:18:02.020","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Liferay CMS Portal version 7.1.3 and 7.2.1 have a blind persistent cross-site scripting (XSS) vulnerability in the user name parameter to Calendar. An attacker can insert the malicious payload on the username, lastname or surname fields of its own profile, and the malicious payload will be injected and reflected in the calendar of the user who submitted the payload. An attacker could escalate its privileges in case an admin visits the calendar that injected the payload."},{"lang":"es","value":"Liferay CMS Portal versiones 7.1.3 y 7.2.1, presenta una vulnerabilidad de tipo cross-site scripting (XSS) persistente ciego en el parámetro user name en Calendario. Un atacante puede insertar una carga útil maliciosa en los campos username, lastname o surname de su propio perfil, y la carga útil maliciosa será inyectada y reflejada en el calendario del usuario que envió la carga útil. Un atacante podría escalar sus privilegios en caso de que un administrador visite el calendario que inyectó la carga útil"}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","baseScore":6.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.7}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:N/I:P/A:N","baseScore":4.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":8.6,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-79"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:liferay:liferay_portal:7.1.3:*:*:*:*:*:*:*","matchCriteriaId":"D4F0F84D-C666-4C8F-9E6A-2C66E1797CB6"},{"vulnerable":true,"criteria":"cpe:2.3:a:liferay:liferay_portal:7.2.1:*:*:*:*:*:*:*","matchCriteriaId":"B795544D-19A9-47A6-B464-CE738F30378B"}]}]}],"references":[{"url":"https://github.com/community-security-team/liferay-portal/compare/7.1.3-ga4...7.1.3-cumulative.patch","source":"cve@mitre.org","tags":["Patch","Third Party Advisory"]},{"url":"https://github.com/community-security-team/liferay-portal/compare/7.2.1-ga2...7.2.1-cumulative.patch","source":"cve@mitre.org","tags":["Patch","Third Party Advisory"]},{"url":"https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/119318646","source":"cve@mitre.org","tags":["Patch","Vendor Advisory"]},{"url":"https://github.com/community-security-team/liferay-portal/compare/7.1.3-ga4...7.1.3-cumulative.patch","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Third Party Advisory"]},{"url":"https://github.com/community-security-team/liferay-portal/compare/7.2.1-ga2...7.2.1-cumulative.patch","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Third Party Advisory"]},{"url":"https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/119318646","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Vendor Advisory"]}]}}]}