CVE-2017-1000425

Cross-site scripting (XSS) vulnerability in the /html/portal/flash.jsp page in Liferay Portal CE 7.0 GA4 and older allows remote attackers to inject arbitrary web script or HTML via a javascript: URI in the "movie" parameter.
Configurations

Configuration 1 (hide)

cpe:2.3:a:liferay:liferay_portal:*:*:*:*:community:*:*:*

History

21 Nov 2024, 03:04

Type Values Removed Values Added
References () https://dev.liferay.com/web/community-security-team/known-vulnerabilities/-/asset_publisher/4AHAYapUm8Xc/content/cst-7030-multiple-xss-vulnerabilities-in-7-0-ce-ga4 - Patch, Vendor Advisory () https://dev.liferay.com/web/community-security-team/known-vulnerabilities/-/asset_publisher/4AHAYapUm8Xc/content/cst-7030-multiple-xss-vulnerabilities-in-7-0-ce-ga4 - Patch, Vendor Advisory
References () https://github.com/liferay/liferay-portal/commit/9435af4ef8a90b5333da925a5ec860a43d18c031 - Patch, Third Party Advisory () https://github.com/liferay/liferay-portal/commit/9435af4ef8a90b5333da925a5ec860a43d18c031 - Patch, Third Party Advisory

Information

Published : 2018-01-02 23:29

Updated : 2024-11-21 03:04


NVD link : CVE-2017-1000425

Mitre link : CVE-2017-1000425

CVE.ORG link : CVE-2017-1000425


JSON object : View

Products Affected

liferay

  • liferay_portal
CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')