CVE-2017-12645: Liferay Portal Vulnerable to XSS via Invalid portletId
Summary
CVE-2017-12645: Liferay Portal Vulnerable to XSS via an Invalid portletId. Affects com.liferay.portal:release.portal.bom versions < 7.0.3-ga4. Fixed in 7.0.3-ga4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Liferay Portal is an open-source platform designed for building enterprise web applications. It provides a robust framework for creating and managing web content, user interfaces, and various enterprise applications. The platform is widely used for its flexibility and extensive feature set, including user management, content management, and integration capabilities. However, it has been identified to have a vulnerability that allows for Cross-Site Scripting (XSS) attacks, specifically through an invalid portletId.
Vulnerability Detail
The vulnerability, identified as CVE-2017-12645, exists in Liferay Portal versions prior to 7.0 CE GA4. It allows attackers to exploit the system by injecting malicious scripts through an invalid portletId. This can lead to unauthorized actions being performed on behalf of users, potentially compromising sensitive information and user sessions. The vulnerability is classified under CWE-79, which pertains to improper neutralization of input during web page generation, leading to XSS. The CVSS score for this vulnerability is 6.1, indicating a moderate severity level.
How To Fix
Latest published version: 7.4.3.132 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
7.0.3-ga4
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, ensure that user inputs are properly validated and sanitized before being processed by the application. Implementing strict input validation can help mitigate the risk of XSS attacks until the package is updated.
Conclusion
In summary, CVE-2017-12645 represents a moderate severity vulnerability in Liferay Portal that allows for XSS attacks via an invalid portletId. It is crucial for users of affected versions to update to the patched version to ensure the security of their applications. Implementing input validation can also serve as a temporary measure until the update is applied.
See every vulnerability recorded for com.liferay.portal:release.portal.bom →
FAQ
CVE-2017-12645 is a vulnerability in Liferay Portal that allows for Cross-Site Scripting (XSS) attacks through an invalid portletId.
Liferay Portal versions prior to 7.0 CE GA4 are affected by this vulnerability.
Attackers can exploit this vulnerability to inject malicious scripts, which may lead to unauthorized actions and compromise user data.
You can use Vulert, which monitors and alerts for open-source vulnerabilities using just the pom.xml file. Visit Vulert Scanner to check your application without any signup.
The recommended action is to update Liferay Portal to version 7.0.3-ga4 or later to mitigate the vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for com.liferay.portal:release.portal.bom.
