Liferay Portal Vulnerable to XSS via an Invalid portletId

Description

References

• nvd.nist.gov/vuln/detail/CVE-2017-12645 · ADVISORY
• liferay/liferay-portal commit 122b0dd · WEB
• liferay/liferay-portal commit 6f2bd25 · WEB
• liferay/liferay-portal commit 89c4514 · WEB
• liferay/liferay-portal commit bbb8bc9 · WEB
• liferay/liferay-portal commit c6d7707 · WEB
• liferay/liferay-portal commit f30571c · WEB
• liferay/liferay-portal · PACKAGE
• issues.liferay.com/browse/LPS-72307 · WEB
• web.archive.org/web/20201001000000*/https://dev.liferay.com/web/community-security-team/known-vulnerabilities/liferay-portal-70/-/asset_publisher/cjE0ourZXJZE/content/cst-7017-multiple-xss-vulnerabilities · WEB
• dev.liferay.com/web/community-security-team/known-vulnerabilities/liferay-portal-70/-/asset_publisher/cjE0ourZXJZE/content/cst-7017-multiple-xss-vulnerabilities · Issue Tracking

Mais vulnerabilidades de com.liferay.portal:release.portal.bom

• CVE-2025-62264MÉDIO 6.1Reflected cross-site scripting (XSS) vulnerability in Languauge Override in Liferay Portal 7.4.3.8 through 7.4.3.111, and Liferay DXP 2023.Q…
• CVE-2025-62265MÉDIO 5.4Cross-site scripting (XSS) vulnerability in the Blogs widget in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and …
• CVE-2025-62266MÉDIO 6.1By default, Liferay Portal 7.4.0 through 7.4.3.119, and older unsupported versions, and Liferay DXP 2024.Q1.1 through 2024.Q1.5, 2023.Q4.0 t…
• CVE-2025-62257MÉDIO 5.3Password enumeration vulnerability in Liferay Portal 7.4.0 through 7.4.3.119, and older unsupported versions, and Liferay DXP 2024.Q1.1 thro…
• CVE-2025-62259MÉDIO 5.4Liferay Portal 7.4.0 through 7.4.3.109, and older unsupported versions, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 9…