GitHub Advisoryadvisory · Maven
GHSA-hq29-vqg6-pjpw Liferay Portal Vulnerable to XSS in Profile Search Functionality
MEDIUM
Official page ↗
- Aliases
- CVE-2016-3670
- Ecosystem
- Maven
- Packages
- com.liferay:com.liferay.portal.search.web
- Severity
- Moderate
- CVSS vector
- CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- Weaknesses
- CWE-79
- Reviewed
- 2025-08-08
Affected packages
• Maven com.liferay:com.liferay.portal.search.web: < 1.0.3 → fixed in 1.0.3
Description
Cross-site scripting (XSS) vulnerability in users.jsp in the Profile Search functionality in Liferay Portal Search Web before 1.0.3 from Liferay (before 7.0.0 CE RC1) allows remote attackers to inject arbitrary web script or HTML via the FirstName field.
Related
Alias · CVE (1)
- CVE-2016-3670 Cross-site scripting (XSS) vulnerability in users.jsp in the Profile Search functionality in Liferay before 7.0.0 CE RC1 allows remote… vulnerability
Weakness · CWE (1)
- CWE-79 Improper Neutralization of Input During Web Page Generation weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2016-3670 advisory
- https://github.com/liferay/liferay-portal/commit/b7ce087039f3b753f36f558df5faefac4ad4b160 web
- https://github.com/liferay/liferay-portal package
- https://issues.liferay.com/browse/LPS-62387 web
- https://labs.integrity.pt/advisories/cve-2016-3670 web
- https://www.exploit-db.com/exploits/39880 web
- http://packetstormsecurity.com/files/137279/Liferay-CE-Stored-Cross-Site-Scripting.html web
- http://seclists.org/fulldisclosure/2016/Jun/5 web
- http://www.securitytracker.com/id/1036083 web