CVE-2016-3670: XSS Vulnerability in Liferay Portal Search Web Package
Summary
CVE-2016-3670: Liferay Portal Vulnerable to XSS in Profile Search Functionality. Affects com.liferay:com.liferay.portal.search.web versions < 1.0.3. Fixed in 1.0.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Liferay Portal Search Web package, identified as com.liferay:com.liferay.portal.search.web, is a component of the Liferay Portal that provides search functionality for user profiles. This package is widely used in web applications that require user search capabilities. However, it has been found to be vulnerable to a cross-site scripting (XSS) attack, which can allow attackers to inject malicious scripts into web pages viewed by users.
Vulnerability Detail
The vulnerability, identified as CVE-2016-3670, is a cross-site scripting (XSS) flaw located in the users.jsp file within the Profile Search functionality of the Liferay Portal Search Web package. This vulnerability allows remote attackers to inject arbitrary web scripts or HTML into the application via the FirstName field. If exploited, this could lead to unauthorized actions being performed on behalf of users, data theft, or other malicious activities.
How To Fix
Minimum fixed version
1.0.3
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate patching is not possible, a temporary workaround is to sanitize user inputs in the FirstName field to prevent script injection. This can be done by implementing input validation and escaping special characters before processing user input.
Conclusion
The CVE-2016-3670 vulnerability in the Liferay Portal Search Web package poses a significant risk due to its potential for XSS attacks. It is crucial to update to the patched version to mitigate this risk and ensure the security of your application.
See every vulnerability recorded for com.liferay:com.liferay.portal.search.web →
FAQ
CVE-2016-3670 is a cross-site scripting (XSS) vulnerability found in the Liferay Portal Search Web package that allows attackers to inject malicious scripts.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which analyzes your pom.xml for vulnerabilities.
Exploiting this vulnerability can lead to unauthorized actions, data theft, and a compromised user experience.
Yes, the vulnerability is fixed in version 1.0.3 of the Liferay Portal Search Web package.
Vulert is a monitoring tool that uses your pom.xml file to alert you in real-time about open-source vulnerabilities in your software.
Related vulnerabilities
Recent vulnerabilities recorded for com.liferay:com.liferay.portal.search.web.
