Liferay Portal CE /html/portal/flash.jsp page cross-site scripting vulnerability

Liferay Portal CE is an open source enterprise networking platform. The platform is used to build company operations, business solutions. A cross-site scripting vulnerability exists in the /html/portal/flash.jsp page in Liferay Portal CE 7.0 GA4 and earlier versions. A remote attacker can exploit...

PT-2018-5200

Name of the Vulnerable Software and Affected Versions Liferay Portal CE versions prior to 7.0 GA4 Description A cross-site scripting XSS issue exists, allowing remote attackers to inject arbitrary web script or HTML via a javascript: URI in the movie parameter in the "/html/portal/flash.jsp" page...