Liferay Portal Vulnerable to XSS via an Invalid portletId

MEDIO 6.1CVE-2017-12645 · GHSA-cvrj-cw2f-25qw · Published 07/08/2017 · updated 17/06/2026

En resumen

CVE-2017-12645 es una vulnerabilidad MEDIO (CVSS 6.1) que afecta a com.liferay.portal:release.portal.bom, liferay portal (liferay).
Probabilidad de explotación en los próximos 30 días (EPSS): 0.61%, mayor que el 49.3% de las vulnerabilidades.
Solución: actualizar a 7.0.3-ga4 o posterior.

Package	Affected versions	Patched versions
com.liferay.portal:release.portal.bom Maven	`< 7.0.3-ga4`	`7.0.3-ga4`
liferay portal liferay	`≤ 7.0`	No fix yet

XSS exists in Liferay Portal before 7.0 CE GA4 via an invalid portletId.

NVD description

XSS exists in Liferay Portal before 7.0 CE GA4 via an invalid portletId.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.