Liferay Portal Vulnerable to XSS via an Invalid portletId

MEDIUM 6.1CVE-2017-12645 · GHSA-cvrj-cw2f-25qw · Published 07/08/2017 · updated 17/06/2026

In short

CVE-2017-12645 is a MEDIUM (CVSS 6.1) vulnerability affecting com.liferay.portal:release.portal.bom, liferay portal (liferay).
Chance of exploitation in the next 30 days (EPSS): 0.61%, higher than 49.3% of all vulnerabilities.
Fix: update to 7.0.3-ga4 or later.

Package	Affected versions	Patched versions
com.liferay.portal:release.portal.bom Maven	`< 7.0.3-ga4`	`7.0.3-ga4`
liferay portal liferay	`≤ 7.0`	No fix yet

XSS exists in Liferay Portal before 7.0 CE GA4 via an invalid portletId.

NVD description

XSS exists in Liferay Portal before 7.0 CE GA4 via an invalid portletId.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.