CVE-2017-12646: Liferay Portal XSS Vulnerability in com.liferay.portal:release.portal.bom, com.liferay:com.liferay.login.authentication.openid.connect.web, and com.liferay:com.liferay.login.web
Summary
CVE-2017-12646: Liferay Portal XSS Vulnerability. Affects com.liferay.portal:release.portal.bom versions < 7.0.3-GA4. Fixed in 7.0.3-GA4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Liferay Portal is an open-source platform designed for building web applications and managing content. It provides a robust framework for developing enterprise-level applications with features such as user management, content management, and collaboration tools. However, certain versions of Liferay Portal are susceptible to a cross-site scripting (XSS) vulnerability, which can compromise the security of applications built on this platform.
Vulnerability Detail
The vulnerability arises from inadequate input validation in Liferay Portal versions prior to 7.0 CE GA4. Specifically, it allows attackers to inject malicious scripts through user inputs such as login names, passwords, or email addresses. This XSS vulnerability can lead to unauthorized access, data theft, and manipulation of user sessions, posing significant risks to both users and the integrity of the application.
How To Fix
Latest published version: 7.4.3.132 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
7.0.3-GA4
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, ensure that user inputs are properly sanitized and validated before processing. Implementing Content Security Policy (CSP) headers can also help mitigate the risk of XSS attacks by restricting the sources from which scripts can be executed.
Conclusion
The CVE-2017-12646 vulnerability in Liferay Portal poses significant risks due to its potential for XSS attacks. It is crucial for developers using affected versions to update their packages to the latest patched versions to mitigate these risks. Utilizing tools like Vulert can help in monitoring and addressing such vulnerabilities effectively.
See every vulnerability recorded for com.liferay.portal:release.portal.bom →
FAQ
CVE-2017-12646 is a cross-site scripting (XSS) vulnerability found in certain versions of Liferay Portal, which can be exploited through user inputs.
You can check if your application is affected by using Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to analyze your pom.xml without any signup.
Exploitation of this vulnerability can lead to unauthorized access, data theft, and manipulation of user sessions, compromising the security of both users and the application.
Update the affected packages in your pom.xml file to the specified patched versions: com.liferay.portal:release.portal.bom to 7.0.3-GA4, com.liferay:com.liferay.login.authentication.openid.connect.web to 1.0.1, and com.liferay:com.liferay.login.web to 1.1.20.
Vulert is a tool that monitors open-source vulnerabilities in your software using just the pom.xml file. It provides real-time alerts and insights into potential security risks.
References
Related vulnerabilities
Recent vulnerabilities recorded for com.liferay.portal:release.portal.bom.
