CVE-2019-16147: Liferay Portal Vulnerable to Cross-Site Scripting (XSS) via a Journal Article Title

May 24, 2022 (updated April 28, 2025)

Liferay Portal through 7.2.0 GA1 allows XSS via a journal article title to journal_article/page.jsp in journal/journal-taglib.

References

github.com/advisories/GHSA-m2gx-7pvx-3gvg
github.com/liferay/liferay-portal
github.com/liferay/liferay-portal/commit/7e063aed70f947a92bb43a4471e0c4e650fe8f7f
nvd.nist.gov/vuln/detail/CVE-2019-16147

Code Behaviors & Features

Detect and mitigate CVE-2019-16147 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →