Skip to content
OpenAdvisories
Medium · 6.1 CVE-2016-10404 EUVD-2016-1586GHSA-jmjf-cmq5-7w25

Liferay Portal Vulnerable to XSS via a Crafted Redirect Field

Published Aug 7, 2017 · Updated Sep 16, 2024 · Assigned by mitre

Package: com.liferay.portal:release.portal.bom Ecosystem: Maven

Description

XSS exists in Liferay Portal before 7.0 CE GA4 via a crafted redirect field to modules/apps/foundation/frontend-js/frontend-js-spa-web/src/main/resources/META-INF/resources/init.jsp.

Affected packages

EcosystemPackageAffectedFixedRecord
Maven com.liferay.portal:release.portal.bom < 7.0.3-ga4 7.0.3-ga4 GHSA-jmjf-cmq5-7w25

References