CVE-2017-12647: Liferay Portal Vulnerable to XSS via Knowledge Base Article Title
Summary
CVE-2017-12647: Liferay Portal Vulnerable to XSS via a Knowledge Base Article Title. Affects com.liferay.portal:release.portal.bom versions < 7.0.3-ga4. Fixed in 7.0.3-ga4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Liferay Portal is an open-source enterprise portal framework that provides a platform for building web applications and managing content. It is widely used for creating intranet and extranet portals, offering features such as document management, collaboration tools, and user management. The vulnerability in question affects versions of Liferay Portal prior to 7.0 CE GA4, where improper handling of user input in Knowledge Base article titles can lead to cross-site scripting (XSS) attacks.
Vulnerability Detail
The vulnerability arises from the way Liferay Portal processes the titles of Knowledge Base articles. An attacker can exploit this flaw by injecting malicious scripts into the title field, which can then be executed in the context of another user's browser. This can lead to unauthorized actions being performed on behalf of the user, data theft, or session hijacking. The vulnerability is classified under CWE-79, which pertains to improper neutralization of input during web page generation, allowing for XSS attacks.
How To Fix
Latest published version: 7.4.3.132 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
7.0.3-ga4
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate patching is not feasible, a temporary workaround is to sanitize user input for Knowledge Base article titles to prevent the execution of scripts. This can be done by implementing input validation and escaping special characters before rendering the title on the web page.
Conclusion
In summary, CVE-2017-12647 is a significant XSS vulnerability in Liferay Portal that can be exploited through Knowledge Base article titles. It is crucial for users of affected versions to update to the patched version to mitigate risks. Additionally, implementing input validation can serve as a temporary workaround while transitioning to the fixed version.
See every vulnerability recorded for com.liferay.portal:release.portal.bom →
FAQ
CVE-2017-12647 is a vulnerability in Liferay Portal that allows for cross-site scripting (XSS) attacks through improperly handled Knowledge Base article titles.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The potential impacts include unauthorized actions on behalf of users, data theft, and session hijacking, which can compromise user accounts and sensitive information.
Yes, the patch is available in version 7.0.3-ga4 of Liferay Portal. It is recommended to update to this version or later.
The CVSS score of this vulnerability is 6.1, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for com.liferay.portal:release.portal.bom.
