Description
Cross-site scripting (XSS) vulnerability in users.jsp in the Profile Search functionality in Liferay before 7.0.0 CE RC1 allows remote attackers to inject arbitrary web script or HTML via the FirstName field.
Exploits (1)
References (6)
Core 6
Core References
Exploit x_refsource_misc
https://labs.integrity.pt/advisories/cve-2016-3670/
Exploit exploit
x_refsource_exploit-db
https://www.exploit-db.com/exploits/39880/
Exploit mailing-list
x_refsource_fulldisc
http://seclists.org/fulldisclosure/2016/Jun/5
Vendor Advisory x_refsource_confirm
https://issues.liferay.com/browse/LPS-62387
Third Party Advisory, VDB Entry vdb-entry
x_refsource_sectrack
http://www.securitytracker.com/id/1036083
Exploit x_refsource_misc
http://packetstormsecurity.com/files/137279/Liferay-CE-Stored-Cross-Site-Scripting.html
Scores
CVSS v3
6.1
EPSS
0.0929
EPSS Percentile
92.8%
Attack Vector
NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Details
CWE
CWE-79
Status
published
Products (2)
com.liferay/com.liferay.portal.search.web
0 - 1.0.3Maven
liferay/liferay_portal
< 6.2
Published
Jun 13, 2016
Tracked Since
Feb 18, 2026