Skip to content
OpenAdvisories
Medium · 6.1 CVE-2017-12646 EUVD-2017-4185GHSA-8gqf-26xw-x3gx

Liferay Portal XSS Vulnerability

Published Aug 7, 2017 · Updated Sep 16, 2024 · Assigned by mitre

Package: com.liferay:com.liferay.login.authentication.openid.connect.web Package: com.liferay:com.liferay.login.web Package: com.liferay.portal:release.portal.bom Ecosystem: Maven

Description

XSS exists in Liferay Portal before 7.0 CE GA4 via a login name, password, or e-mail address.

Affected packages

EcosystemPackageAffectedFixedRecord
Maven com.liferay:com.liferay.login.authentication.openid.connect.web >= 1.0.0, < 1.0.1 1.0.1 GHSA-8gqf-26xw-x3gx
Maven com.liferay:com.liferay.login.web < 1.1.20 1.1.20 GHSA-8gqf-26xw-x3gx
Maven com.liferay.portal:release.portal.bom < 7.0.3-GA4 7.0.3-GA4 GHSA-8gqf-26xw-x3gx

References