{"action":"Upgrade com.liferay:com.liferay.portal.search.web to 1.0.3 or later.","affected":[{"fixed":"1.0.3","introduced":"0"}],"component":"com.liferay:com.liferay.portal.search.web","cve_ids":["CVE-2016-3670"],"ecosystem":"Maven","epss":0.02491,"exploited":false,"fixed_versions":["1.0.3"],"ghsa_id":"GHSA-hq29-vqg6-pjpw","id":"tcs_01M5N913ES1P43X7NY9MHEZHJH","modified_at":"2025-08-08T21:57:18.656914Z","published_at":"2022-05-17T03:53:10Z","references":["https://osv.dev/vulnerability/GHSA-hq29-vqg6-pjpw","https://nvd.nist.gov/vuln/detail/CVE-2016-3670","https://github.com/liferay/liferay-portal/commit/b7ce087039f3b753f36f558df5faefac4ad4b160","https://github.com/liferay/liferay-portal","https://issues.liferay.com/browse/LPS-62387","https://labs.integrity.pt/advisories/cve-2016-3670","https://www.exploit-db.com/exploits/39880","http://packetstormsecurity.com/files/137279/Liferay-CE-Stored-Cross-Site-Scripting.html","http://seclists.org/fulldisclosure/2016/Jun/5","http://www.securitytracker.com/id/1036083"],"severity":{"label":"medium","score":6.1},"sources":[{"source":"osv","source_id":"GHSA-hq29-vqg6-pjpw","url":"https://osv.dev/vulnerability/GHSA-hq29-vqg6-pjpw"}],"summary":"Liferay Portal Vulnerable to XSS in Profile Search Functionality"}