CVE-2016-10404: Liferay Portal XSS Vulnerability via Crafted Redirect Field
Summary
CVE-2016-10404: Liferay Portal Vulnerable to XSS via a Crafted Redirect Field. Affects com.liferay.portal:release.portal.bom versions < 7.0.3-ga4. Fixed in 7.0.3-ga4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Liferay Portal is a popular open-source platform designed for building web applications and managing digital experiences. It offers features such as content management, collaboration tools, and user management. However, prior to version 7.0 CE GA4, Liferay Portal was found to be vulnerable to cross-site scripting (XSS) attacks, which could be exploited through a crafted redirect field.
Vulnerability Detail
The vulnerability, identified as CVE-2016-10404, arises from improper handling of user input in the redirect field within Liferay Portal. Attackers can exploit this flaw by crafting a malicious URL that redirects users to a harmful site, potentially leading to unauthorized access, data theft, or other malicious activities. The vulnerability is classified under CWE-79, indicating it is related to improper input validation that allows for XSS attacks.
How To Fix
Latest published version: 7.4.3.132 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
7.0.3-ga4
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If an immediate update is not feasible, consider implementing input validation and sanitization on the redirect field to prevent malicious scripts from being executed. This can be done by ensuring that any user input is properly encoded before being rendered on the page.
Conclusion
In summary, CVE-2016-10404 is a significant XSS vulnerability in Liferay Portal that can be exploited through a crafted redirect field. It is crucial to update to the patched version 7.0.3-ga4 or later to mitigate this risk. Additionally, implementing input validation can serve as a temporary workaround while planning for an update.
See every vulnerability recorded for com.liferay.portal:release.portal.bom →
FAQ
CVE-2016-10404 is a vulnerability in Liferay Portal that allows for cross-site scripting (XSS) attacks via a crafted redirect field.
If you are using a version prior to 7.0.3-ga4, your installation is vulnerable to this issue.
Exploitation of this vulnerability can lead to unauthorized access, data theft, and other malicious activities affecting users of the portal.
Yes, tools like Vulert can monitor your project for open-source vulnerabilities using just the pom.xml file, providing real-time alerts.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Related vulnerabilities
Recent vulnerabilities recorded for com.liferay.portal:release.portal.bom.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
