CVE-2017-1000425: Liferay Portal XSS Vulnerability via Movie Parameter in Flash Page
Summary
CVE-2017-1000425: Liferay Portal XSS vulnerability via movie parameter in the /html/portal/flash.jsp page. Affects com.liferay.portal:release.portal.bom versions < 7.1.0-a1. Fixed in 7.1.0-a1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Liferay Portal is an open-source platform designed for building web applications and websites. It provides a robust framework for managing content, user interactions, and enterprise applications. However, certain versions of Liferay Portal, specifically 7.0 GA4 and older, are susceptible to a cross-site scripting (XSS) vulnerability that can be exploited through the 'movie' parameter in the /html/portal/flash.jsp page.
Vulnerability Detail
The vulnerability arises from improper validation of user input in the 'movie' parameter, allowing attackers to inject arbitrary web scripts or HTML. This can lead to unauthorized actions being performed on behalf of users, data theft, or redirection to malicious sites. The XSS vulnerability is classified under CWE-79, indicating a failure to sanitize user input effectively.
How To Fix
Latest published version: 7.4.3.132 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
7.1.0-a1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If an immediate update is not feasible, consider implementing input validation and sanitization on the 'movie' parameter to mitigate the risk of XSS attacks. This can be done by encoding or stripping out potentially harmful characters from user input before processing it.
Conclusion
In summary, the CVE-2017-1000425 vulnerability in Liferay Portal poses a significant risk due to improper input validation in the 'movie' parameter. Updating to the patched version is crucial for maintaining application security. Additionally, using tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for com.liferay.portal:release.portal.bom →
FAQ
The CVSS score of this vulnerability is 6.1, indicating a moderate level of severity.
Liferay Portal CE 7.0 GA4 and older versions are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Exploitation of this vulnerability can lead to unauthorized actions, data theft, and redirection to malicious sites, compromising user security.
Yes, you can implement input validation and sanitization on the 'movie' parameter to reduce the risk of XSS attacks.
Related vulnerabilities
Recent vulnerabilities recorded for com.liferay.portal:release.portal.bom.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
