Summary

NASA Marshall Space Flight Center (MSFC) Directives Master List (DML) (dml.msfc.nasa.gov) is vulnerable to a reflected cross-site scripting (XSS) vulnerability in Liferay Portal and Liferay DXP which allows an remote non-authenticated attacker to inject JavaScript into the modules/apps/marketplace/marketplace-app-manager-web

When an attacker can control code that is executed within a user’s browser, they are able to carry out any actions that the user is able to perform, including accessing any of the user’s data and modifying information within the user’s permissions. This can result in modification, deletion, or theft of data, including accessing or deleting files, or stealing session cookies which an attacker could use to hijack a user’s session.

Proof of Concept (PoC)

Activity Feed