CVE-2016-3670

Cross-site scripting (XSS) vulnerability in users.jsp in the Profile Search functionality in Liferay before 7.0.0 CE RC1 allows remote attackers to inject arbitrary web script or HTML via the FirstName field.
Cross-site Scripting
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
6.1 MEDIUM
NETWORK
LOW
NONE
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
mitreCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 92%
VendorProductVersion
liferayliferay_portal
𝑥
≤ 6.2
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
http://packetstormsecurity.com/files/137279/Liferay-CE-Stored-Cross-Site-Scripting.html
http://seclists.org/fulldisclosure/2016/Jun/5
http://www.securitytracker.com/id/1036083
https://issues.liferay.com/browse/LPS-62387
https://labs.integrity.pt/advisories/cve-2016-3670/
https://www.exploit-db.com/exploits/39880/
http://packetstormsecurity.com/files/137279/Liferay-CE-Stored-Cross-Site-Scripting.html
http://seclists.org/fulldisclosure/2016/Jun/5
http://www.securitytracker.com/id/1036083
https://issues.liferay.com/browse/LPS-62387
https://labs.integrity.pt/advisories/cve-2016-3670/
https://www.exploit-db.com/exploits/39880/