VulnerabilityModified

CVE-2016-3670

Cross-site scripting (XSS) vulnerability in users.jsp in the Profile Search functionality in Liferay before 7.0.0 CE RC1 allows remote attackers to inject arbitrary web script or HTML via the FirstName field.

MEDIUM 6.1EPSS 2.49%

Does this matter?

Lower severity and a low EPSS score (2.49%). Track it; it rarely justifies an emergency change on its own.

Description

CVSS 3.0: 6.1 MEDIUMCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
EPSS: 2.49% probability · 84th percentile
CISA KEV: Not listed
Weakness: CWE-79
Affected: liferay/liferay portal
Source: cve@mitre.org

References

http://packetstormsecurity.com/files/137279/Liferay-CE-Stored-Cross-Site-Scripting.htmlExploit
http://seclists.org/fulldisclosure/2016/Jun/5Exploit
http://www.securitytracker.com/id/1036083
https://issues.liferay.com/browse/LPS-62387Vendor Advisory
https://labs.integrity.pt/advisories/cve-2016-3670/Exploit
https://www.exploit-db.com/exploits/39880/Exploit
http://packetstormsecurity.com/files/137279/Liferay-CE-Stored-Cross-Site-Scripting.htmlExploit
http://seclists.org/fulldisclosure/2016/Jun/5Exploit
http://www.securitytracker.com/id/1036083
https://issues.liferay.com/browse/LPS-62387Vendor Advisory
https://labs.integrity.pt/advisories/cve-2016-3670/Exploit
https://www.exploit-db.com/exploits/39880/Exploit

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.