CVE-2017-12645

Liferay Portal Vulnerable to XSS via an Invalid portletId

6.1 MediumFix available

XSS exists in Liferay Portal before 7.0 CE GA4 via an invalid portletId.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: Required

What an attacker can affect

Confidentiality: Low
Integrity: Low
Availability: None

Exploit likelihood

0.61%Unchanged since Apr 14, 2021

What each source reports

NVD Score used 6.1

XSS exists in Liferay Portal before 7.0 CE GA4 via an invalid portletId.

Record: CVE-2017-12645
CVSS 3.0: 6.1 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS 2.0: 4.3 MediumAV:N/AC:M/Au:N/C:N/I:P/A:N
Weakness: CWE-79
Updated: 2026-11-02

CVE List No score

XSS exists in Liferay Portal before 7.0 CE GA4 via an invalid portletId.

Record: CVE-2017-12645
Updated: 2026-11-02

EUVDEUVD-2017-4184 No score

XSS exists in Liferay Portal before 7.0 CE GA4 via an invalid portletId.

Record: EUVD-2017-4184
Updated: 2026-11-03

GitHub AdvisoriesGHSA-cvrj-cw2f-25qw 6.1

Liferay Portal Vulnerable to XSS via an Invalid portletId

XSS exists in Liferay Portal before 7.0 CE GA4 via an invalid portletId.

Record: GHSA-cvrj-cw2f-25qw
CVSS 3.0: 6.1 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness: CWE-79
Updated: 2026-11-02

OSVGHSA-cvrj-cw2f-25qw 6.1

Liferay Portal Vulnerable to XSS via an Invalid portletId

XSS exists in Liferay Portal before 7.0 CE GA4 via an invalid portletId.

Record: GHSA-cvrj-cw2f-25qw
CVSS 3.0: 6.1 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness: CWE-79
Updated: 2026-11-02

Affected products

liferay portal

Affected packages

Affected packages
Package	Affected	Fixed
`com.liferay.portal:release.portal.bom` Maven	before 7.0.3-ga4	7.0.3-ga4

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2017-12645 is a medium vulnerability (CVSS 6.1) in Liferay Portal, published August 7, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.61%, the 49th percentile. Fixed in com.liferay.portal:release.portal.bom 7.0.3-ga4.

References

Show 6 moreShow less