CVE-2017-6003: Improper Neutralization of Input During Web Page Generation

dotCMS 3.7.0 has XSS reachable from ext/languagesmanager/editlanguage in portal/layout via the bottom two form fields...