CVE-2017-12648: Liferay Portal XSS Vulnerability in com.liferay.portal:release.portal.bom and com.liferay:com.liferay.frontend.taglib
Summary
CVE-2017-12648: Liferay Portal XSS Vulnerability. Affects com.liferay.portal:release.portal.bom versions < 7.0.3-GA4. Fixed in 7.0.3-GA4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Liferay Portal is an open-source platform designed for building and managing web applications. It provides a robust framework for creating customizable user experiences and supports various functionalities such as content management, collaboration, and workflow automation. The affected packages, com.liferay.portal:release.portal.bom and com.liferay:com.liferay.frontend.taglib, are integral to the Liferay ecosystem, enabling developers to leverage Liferay's capabilities effectively. However, these packages are vulnerable to a cross-site scripting (XSS) attack, which can compromise the security of applications built on this platform.
Vulnerability Detail
The vulnerability identified as CVE-2017-12648 is an XSS flaw present in Liferay Portal versions prior to 7.0 CE GA4. This vulnerability arises from improper handling of user input in bookmark URLs, allowing attackers to inject malicious scripts. If exploited, this could lead to unauthorized access to sensitive information, session hijacking, or other malicious activities that could severely impact users and the integrity of the application. The vulnerability has a CVSS score of 6.1, indicating a moderate severity level.
How To Fix
Latest published version: 7.4.3.132 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
7.0.3-GA4
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate patching is not feasible, a temporary workaround is to sanitize user inputs and validate bookmark URLs to prevent the execution of malicious scripts. Implementing input validation and encoding user-generated content can help mitigate the risk of XSS attacks until the packages are updated.
Conclusion
In summary, CVE-2017-12648 is a moderate severity XSS vulnerability in Liferay Portal that can lead to significant security risks if not addressed. It is crucial to update the affected packages to their patched versions to safeguard your applications. Additionally, implementing workarounds can help mitigate risks until updates are applied.
See every vulnerability recorded for com.liferay.portal:release.portal.bom →
FAQ
CVE-2017-12648 is a cross-site scripting (XSS) vulnerability found in Liferay Portal that allows attackers to inject malicious scripts through bookmark URLs.
Liferay Portal versions prior to 7.0 CE GA4 are affected by this vulnerability.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. You can check if your application is affected by visiting the Vulert playground at Vulert Scanner without any signup.
If you cannot update the packages immediately, implement input validation and sanitize user inputs to mitigate the risk of XSS attacks as a temporary workaround.
The CVSS score of this vulnerability is 6.1, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for com.liferay.portal:release.portal.bom.
