Medium
Security advisory
In Liferay Portal before 7.1 CE GA4, an XSS vulnerability exists in the SimpleCaptcha API when custom code passes unsanitized input into the "url" parameter of the JSP taglib call or . Liferay Portal out-of-the-box behavior with no customizations is not vulnerable.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2019-6588
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 04:23 UTC · Revision 1
Source evidence
In Liferay Portal before 7.1 CE GA4, an XSS vulnerability exists in the SimpleCaptcha API when custom code passes unsanitized input into the "url" parameter of the JSP taglib call or . Liferay Portal out-of-the-box behavior with no customizations is not vulnerable.
osv:CVE-2019-6588
Complete source record
{
"id": "f6fcda7b5a9447ec835893624704e60025298279978db6cb35d7695f5798cb4b",
"url": "https://osv.dev/vulnerability/CVE-2019-6588",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2019-6588",
"summary": "In Liferay Portal before 7.1 CE GA4, an XSS vulnerability exists in the SimpleCaptcha API when custom code passes unsanitized input into the \"url\" parameter of the JSP taglib call or . Liferay Portal out-of-the-box behavior with no customizations is not vulnerable.",
"evidence": "osv:CVE-2019-6588",
"products": [],
"severity": "medium",
"structured": {
"id": "CVE-2019-6588",
"aliases": [
"CVE-2019-6588",
"GHSA-hwp2-gvm5-452f"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/liferay/liferay-portal",
"type": "GIT",
"events": [
{
"introduced": "73c2fa07b6d1ce2d0b52d290fda7c859ed3ec5d9"
},
{
"last_affected": "439f94cc22eea87c56abb3405b6f8e3ba705dacb"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:liferay:liferay_portal:6.1.0:b1:*:*:community:*:*:*",
"range": [
{
"introduced": "6.1.0-b1"
},
{
"last_affected": "6.1.0-b1"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:liferay:liferay_portal:6.1.0:ga1:*:*:community:*:*:*",
"range": [
{
"introduced": "6.1.0-ga1"
},
{
"last_affected": "6.1.0-ga1"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:liferay:liferay_portal:6.1.0:b2:*:*:community:*:*:*",
"range": [
{
"introduced": "6.1.0-b2"
},
{
"last_affected": "6.1.0-b2"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:liferay:liferay_portal:6.1.0:b3:*:*:community:*:*:*",
"range": [
{
"introduced": "6.1.0-b3"
},
{
"last_affected": "6.1.0-b3"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:liferay:liferay_portal:6.1.0:b4:*:*:community:*:*:*",
"range": [
{
"introduced": "6.1.0-b4"
},
{
"last_affected": "6.1.0-b4"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:liferay:liferay_portal:6.1.0:rc1:*:*:community:*:*:*",
"range": [
{
"introduced": "6.1.0-rc1"
},
{
"last_affected": "6.1.0-rc1"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:liferay:liferay_portal:6.1.1:ga2:*:*:community:*:*:*",
"range": [
{
"introduced": "6.1.1-ga2"
},
{
"last_affected": "6.1.1-ga2"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:liferay:liferay_portal:6.1.2:ga3:*:*:community:*:*:*",
"range": [
{
"introduced": "6.1.2-ga3"
},
{
"last_affected": "6.1.2-ga3"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:liferay:liferay_portal:6.2.0:b1:*:*:community:*:*:*",
"range": [
{
"introduced": "6.2.0-b1"
},
{
"last_affected": "6.2.0-b1"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:liferay:liferay_portal:6.2.0:ga1:*:*:community:*:*:*",
"range": [
{
"introduced": "6.2.0-ga1"
},
{
"last_affected": "6.2.0-ga1"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:liferay:liferay_portal:6.2.0:m1:*:*:community:*:*:*",
"range": [
{
"introduced": "6.2.0-m1"
},
{
"last_affected": "6.2.0-m1"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:liferay:liferay_portal:6.2.0:b2:*:*:community:*:*:*",
"range": [
{
"introduced": "6.2.0-b2"
},
{
"last_affected": "6.2.0-b2"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:liferay:liferay_portal:6.2.0:m2:*:*:community:*:*:*",
"range": [
{
"introduced": "6.2.0-m2"
},
{
"last_affected": "6.2.0-m2"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:liferay:liferay_portal:6.2.0:m3:*:*:community:*:*:*",
"range": [
{
"introduced": "6.2.0-m3"
},
{
"last_affected": "6.2.0-m3"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:liferay:liferay_portal:6.2.0:m4:*:*:community:*:*:*",
"range": [
{
"introduced": "6.2.0-m4"
},
{
"last_affected": "6.2.0-m4"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:liferay:liferay_portal:6.2.0:m5:*:*:community:*:*:*",
"range": [
{
"introduced": "6.2.0-m5"
},
{
"last_affected": "6.2.0-m5"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:liferay:liferay_portal:6.2.0:m6:*:*:community:*:*:*",
"range": [
{
"introduced": "6.2.0-m6"
},
{
"last_affected": "6.2.0-m6"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:liferay:liferay_portal:6.2.0:rc1:*:*:community:*:*:*",
"range": [
{
"introduced": "6.2.0-rc1"
},
{
"last_affected": "6.2.0-rc1"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:liferay:liferay_portal:6.2.0:rc2:*:*:community:*:*:*",
"range": [
{
"introduced": "6.2.0-rc2"
},
{
"last_affected": "6.2.0-rc2"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:liferay:liferay_portal:6.2.0:rc3:*:*:community:*:*:*",
"range": [
{
"introduced": "6.2.0-rc3"
},
{
"last_affected": "6.2.0-rc3"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:liferay:liferay_portal:6.2.0:rc4:*:*:community:*:*:*",
"range": [
{
"introduced": "6.2.0-rc4"
},
{
"last_affected": "6.2.0-rc4"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:liferay:liferay_portal:6.2.0:rc5:*:*:community:*:*:*",
"range": [
{
"introduced": "6.2.0-rc5"
},
{
"last_affected": "6.2.0-rc5"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:liferay:liferay_portal:6.2.0:rc6:*:*:community:*:*:*",
"range": [
{
"introduced": "6.2.0-rc6"
},
{
"last_affected": "6.2.0-rc6"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:liferay:liferay_portal:6.2.1:ga2:*:*:community:*:*:*",
"range": [
{
"introduced": "6.2.1-ga2"
},
{
"last_affected": "6.2.1-ga2"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:liferay:liferay_portal:6.2.2:ga3:*:*:community:*:*:*",
"range": [
{
"introduced": "6.2.2-ga3"
},
{
"last_affected": "6.2.2-ga3"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:liferay:liferay_portal:6.2.3:ga4:*:*:community:*:*:*",
"range": [
{
"introduced": "6.2.3-ga4"
},
{
"last_affected": "6.2.3-ga4"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:liferay:liferay_portal:6.2.4:ga5:*:*:community:*:*:*",
"range": [
{
"introduced": "6.2.4-ga5"
},
{
"last_affected": "6.2.4-ga5"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:liferay:liferay_portal:6.2.5:ga6:*:*:community:*:*:*",
"range": [
{
"introduced": "6.2.5-ga6"
},
{
"last_affected": "6.2.5-ga6"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:liferay:liferay_portal:7.0.0:a1:*:*:community:*:*:*",
"range": [
{
"introduced": "7.0.0-a1"
},
{
"last_affected": "7.0.0-a1"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:liferay:liferay_portal:7.0.0:b1:*:*:community:*:*:*",
"range": [
{
"introduced": "7.0.0-b1"
},
{
"last_affected": "7.0.0-b1"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:liferay:liferay_portal:7.0.0:ga1:*:*:community:*:*:*",
"range": [
{
"introduced": "7.0.0-ga1"
},
{
"last_affected": "7.0.0-ga1"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:liferay:liferay_portal:7.0.0:m1:*:*:community:*:*:*",
"range": [
{
"introduced": "7.0.0-m1"
},
{
"last_affected": "7.0.0-m1"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:liferay:liferay_portal:7.0.0:a2:*:*:community:*:*:*",
"range": [
{
"introduced": "7.0.0-a2"
},
{
"last_affected": "7.0.0-a2"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:liferay:liferay_portal:7.0.0:b2:*:*:community:*:*:*",
"range": [
{
"introduced": "7.0.0-b2"
},
{
"last_affected": "7.0.0-b2"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:liferay:liferay_portal:7.0.0:m2:*:*:community:*:*:*",
"range": [
{
"introduced": "7.0.0-m2"
},
{
"last_affected": "7.0.0-m2"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:liferay:liferay_portal:7.0.0:a3:*:*:community:*:*:*",
"range": [
{
"introduced": "7.0.0-a3"
},
{
"last_affected": "7.0.0-a3"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:liferay:liferay_portal:7.0.0:b3:*:*:community:*:*:*",
"range": [
{
"introduced": "7.0.0-b3"
},
{
"last_affected": "7.0.0-b3"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:liferay:liferay_portal:7.0.0:m3:*:*:community:*:*:*",
"range": [
{
"introduced": "7.0.0-m3"
},
{
"last_affected": "7.0.0-m3"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:liferay:liferay_portal:7.0.0:a4:*:*:community:*:*:*",
"range": [
{
"introduced": "7.0.0-a4"
},
{
"last_affected": "7.0.0-a4"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:liferay:liferay_portal:7.0.0:b4:*:*:community:*:*:*",
"range": [
{
"introduced": "7.0.0-b4"
},
{
"last_affected": "7.0.0-b4"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:liferay:liferay_portal:7.0.0:m4:*:*:community:*:*:*",
"range": [
{
"introduced": "7.0.0-m4"
},
{
"last_affected": "7.0.0-m4"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:liferay:liferay_portal:7.0.0:a5:*:*:community:*:*:*",
"range": [
{
"introduced": "7.0.0-a5"
},
{
"last_affected": "7.0.0-a5"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:liferay:liferay_portal:7.0.0:b5:*:*:community:*:*:*",
"range": [
{
"introduced": "7.0.0-b5"
},
{
"last_affected": "7.0.0-b5"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:liferay:liferay_portal:7.0.0:m5:*:*:community:*:*:*",
"range": [
{
"introduced": "7.0.0-m5"
},
{
"last_affected": "7.0.0-m5"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:liferay:liferay_portal:7.0.0:b6:*:*:community:*:*:*",
"range": [
{
"introduced": "7.0.0-b6"
},
{
"last_affected": "7.0.0-b6"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:liferay:liferay_portal:7.0.0:m6:*:*:community:*:*:*",
"range": [
{
"introduced": "7.0.0-m6"
},
{
"last_affected": "7.0.0-m6"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:liferay:liferay_portal:7.0.0:b7:*:*:community:*:*:*",
"range": [
{
"introduced": "7.0.0-b7"
},
{
"last_affected": "7.0.0-b7"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:liferay:liferay_portal:7.0.0:m7:*:*:community:*:*:*",
"range": [
{
"introduced": "7.0.0-m7"
},
{
"last_affected": "7.0.0-m7"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:liferay:liferay_portal:7.0.1:ga2:*:*:community:*:*:*",
"range": [
{
"introduced": "7.0.1-ga2"
},
{
"last_affected": "7.0.1-ga2"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:liferay:liferay_portal:7.0.2:ga3:*:*:community:*:*:*",
"range": [
{
"introduced": "7.0.2-ga3"
},
{
"last_affected": "7.0.2-ga3"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:liferay:liferay_portal:7.0.3:ga4:*:*:community:*:*:*",
"range": [
{
"introduced": "7.0.3-ga4"
},
{
"last_affected": "7.0.3-ga4"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:liferay:liferay_portal:7.0.4:ga5:*:*:community:*:*:*",
"range": [
{
"introduced": "7.0.4-ga5"
},
{
"last_affected": "7.0.4-ga5"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:liferay:liferay_portal:7.0.5:ga6:*:*:community:*:*:*",
"range": [
{
"introduced": "7.0.5-ga6"
},
{
"last_affected": "7.0.5-ga6"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:liferay:liferay_portal:7.0.6:ga7:*:*:community:*:*:*",
"range": [
{
"introduced": "7.0.6-ga7"
},
{
"last_affected": "7.0.6-ga7"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:liferay:liferay_portal:7.1.0:a1:*:*:community:*:*:*",
"range": [
{
"introduced": "7.1.0-a1"
},
{
"last_affected": "7.1.0-a1"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:liferay:liferay_portal:7.1.0:b1:*:*:community:*:*:*",
"range": [
{
"introduced": "7.1.0-b1"
},
{
"last_affected": "7.1.0-b1"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:liferay:liferay_portal:7.1.0:ga1:*:*:community:*:*:*",
"range": [
{
"introduced": "7.1.0-ga1"
},
{
"last_affected": "7.1.0-ga1"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:liferay:liferay_portal:7.1.0:m1:*:*:community:*:*:*",
"range": [
{
"introduced": "7.1.0-m1"
},
{
"last_affected": "7.1.0-m1"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:liferay:liferay_portal:7.1.0:a2:*:*:community:*:*:*",
"range": [
{
"introduced": "7.1.0-a2"
},
{
"last_affected": "7.1.0-a2"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:liferay:liferay_portal:7.1.0:b2:*:*:community:*:*:*",
"range": [
{
"introduced": "7.1.0-b2"
},
{
"last_affected": "7.1.0-b2"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:liferay:liferay_portal:7.1.0:m2:*:*:community:*:*:*",
"range": [
{
"introduced": "7.1.0-m2"
},
{
"last_affected": "7.1.0-m2"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:liferay:liferay_portal:7.1.0:b3:*:*:community:*:*:*",
"range": [
{
"introduced": "7.1.0-b3"
},
{
"last_affected": "7.1.0-b3"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:liferay:liferay_portal:7.1.0:rc1:*:*:community:*:*:*",
"range": [
{
"introduced": "7.1.0-rc1"
},
{
"last_affected": "7.1.0-rc1"
}
],
"source": "CPE_STRING"
}
]
}
}
],
"versions": [
"6.1.0-b1",
"6.1.0-b2",
"6.1.0-b3",
"6.1.0-b4",
"6.1.0-rc1",
"6.1.1-ga2",
"6.1.2-ga3",
"6.2.0-b1",
"6.2.0-b2",
"6.2.0-m3",
"6.2.0-m4",
"6.2.0-m5",
"6.2.0-m6",
"6.2.0-rc1",
"6.2.0-rc2",
"6.2.0-rc3",
"6.2.0-rc4",
"6.2.0-rc5",
"6.2.0-rc6",
"6.2.1-ga2",
"6.2.2-ga3",
"6.2.3-ga4",
"6.2.4-ga5",
"6.2.5-ga6",
"7.0.0-a1",
"7.0.0-a2",
"7.0.0-a3",
"7.0.0-a4",
"7.0.0-a5",
"7.0.0-b6",
"7.0.0-b7",
"7.0.1-ga2",
"7.0.2-ga3",
"7.0.3-ga4",
"7.0.4-ga5",
"7.0.5-ga6",
"7.0.6-ga7",
"7.1.0-a1",
"7.1.0-a2",
"7.1.0-b3",
"7.1.0-rc1"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-6588.json"
}
}
],
"modified": "2026-10-24T10:30:18.236130820Z",
"provider": "osv",
"references": [
"https://dev.liferay.com/web/community-security-team/known-vulnerabilities/liferay-portal-71/-/asset_publisher/7v4O7y85hZMo/content/cst-7130-multiple-xss-vulnerabilities-in-7-1-ce-ga3"
],
"provider_metadata": {
"unresolved_ranges": [
{
"cpes": [
"cpe:2.3:a:liferay:liferay_portal:*:*:*:*:community:*:*:*"
],
"vendor_product": "liferay:liferay_portal",
"extracted_events": [
{
"range": [
{
"last_affected": "6.0.6"
}
],
"source": "CPE_RANGE"
}
]
}
]
}
},
"related_cves": [
{
"value": "CVE-2019-6588",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 429727,
"published_at": "2019-06-03T20:29:01.547+00:00"
}