CVE-2016-10404

2017-08-0716:29:00

Google

osv.dev

5.8 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

33.7%

JSON

XSS exists in Liferay Portal before 7.0 CE GA4 via a crafted redirect field to modules/apps/foundation/frontend-js/frontend-js-spa-web/src/main/resources/META-INF/resources/init.jsp.

CPENameOperatorVersion
liferay-portaleq6.2.0-b2
liferay-portaleqsync-3.1.0-ga1
liferay-portaleq6.2.0-m2
liferay-portaleq7.0.0-m4
liferay-portaleqsync-3.0.10-ga2
liferay-portaleqsync-3.0.1-b2
liferay-portaleqsync-3.0.5-b6
liferay-portaleq7.0.0-m2
liferay-portaleq6.1.0-b3
liferay-portaleq6.2.0-m6

Name	Operator	Version
liferay-portal	eq	6.2.0-b2
liferay-portal	eq	sync-3.1.0-ga1
liferay-portal	eq	6.2.0-m2
liferay-portal	eq	7.0.0-m4
liferay-portal	eq	sync-3.0.10-ga2
liferay-portal	eq	sync-3.0.1-b2
liferay-portal	eq	sync-3.0.5-b6
liferay-portal	eq	7.0.0-m2
liferay-portal	eq	6.1.0-b3
liferay-portal	eq	6.2.0-m6

Rows per page:

1-10 of 291

References

dev.liferay.com/web/community-security-team/known-vulnerabilities/liferay-portal-70/-/asset_publisher/cjE0ourZXJZE/content/cst-7017-multiple-xss-vulnerabilities

github.com/liferay/liferay-portal/commit/333f65bae9106182d12e02d249d4f95e16e93fa2