What is GHSA-hq29-vqg6-pjpw?

GHSA-hq29-vqg6-pjpw is a security advisory published by GitHub Security Advisories with Medium severity. Liferay Portal Vulnerable to XSS in Profile Search Functionality

Which CVE IDs does GHSA-hq29-vqg6-pjpw cover?

GHSA-hq29-vqg6-pjpw covers the following CVE IDs: CVE-2016-3670. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-hq29-vqg6-pjpw?

GHSA-hq29-vqg6-pjpw has a CVSS v3 base score of 6.1, published by GitHub Security Advisories.

Which products are affected by GHSA-hq29-vqg6-pjpw?

GHSA-hq29-vqg6-pjpw affects 1 product, including: maven/com.liferay:com.liferay.portal.search.web:\u003c 1.0.3.

GHSA-hq29-vqg6-pjpwMediumCVSS 6.1

Liferay Portal Vulnerable to XSS in Profile Search Functionality

Vendor

GitHub Security Advisories

Published

May 17, 2022

Last Modified

August 8, 2025

🔗 CVE IDs covered (1)

CVE-2016-3670 →

📋 Description

Cross-site scripting (XSS) vulnerability in users.jsp in the Profile Search functionality in Liferay Portal Search Web before 1.0.3 from Liferay (before 7.0.0 CE RC1) allows remote attackers to inject arbitrary web script or HTML via the FirstName field.

🎯 Affected products1

maven/com.liferay:com.liferay.portal.search.web:< 1.0.3

🔗 References (9)

https://nvd.nist.gov/vuln/detail/CVE-2016-3670
https://issues.liferay.com/browse/LPS-62387
http://packetstormsecurity.com/files/137279/Liferay-CE-Stored-Cross-Site-Scripting.html
http://seclists.org/fulldisclosure/2016/Jun/5
http://www.securitytracker.com/id/1036083
https://github.com/liferay/liferay-portal/commit/b7ce087039f3b753f36f558df5faefac4ad4b160
https://labs.integrity.pt/advisories/cve-2016-3670
https://www.exploit-db.com/exploits/39880
https://github.com/advisories/GHSA-hq29-vqg6-pjpw