packetstormsecurity.com
http://packetstormsecurity.com/files/137279/Liferay-CE-Stored-Cross-Site-Scripting.html CVE-2016-3670
MEDIUM
Liferay Portal Vulnerable to XSS in Profile Search Functionality
Record summary
CVE-2016-3670 has a selected CVSS score of 6.1 (medium); EIP currently links 1 catalogued exploit.
Description
Cross-site scripting (XSS) vulnerability in users.jsp in the Profile Search functionality in Liferay before 7.0.0 CE RC1 allows remote attackers to inject arbitrary web script or HTML via the FirstName field.
Description source: CVE List
Exploitation context
Available material
- Catalogued exploits
- 1
Affected products and versions
1| Product | Source | Version range | Status |
|---|---|---|---|
com.liferay:com.liferay.portal.search.webBrowse Maven / com.liferay:com.liferay.portal.search.web | GitHub Advisory | Before 1.0.3 · Fixed in 1.0.3 | affected |
Proofs of concept
1Catalogued exploits
ExploitDBLiferay CE < 6.2 CE GA6 - Persistent Cross-Site ScriptingExploitDB exploitby Fernando CâmaraNot analyzed1 file
References
920160601 CVE-2016-3670 Stored Cross Site Scripting in Liferay CEmailing list
http://seclists.org/fulldisclosure/2016/Jun/5 1036083vdb entry
http://www.securitytracker.com/id/1036083 github.com
https://github.com/liferay/liferay-portal github.com
https://github.com/liferay/liferay-portal/commit/b7ce087039f3b753f36f558df5faefac4ad4b160 issues.liferay.comConfirmation
https://issues.liferay.com/browse/LPS-62387 labs.integrity.pt
https://labs.integrity.pt/advisories/cve-2016-3670 nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2016-3670 39880exploit
https://www.exploit-db.com/exploits/39880