CVE-2019-16147: Liferay Portal Vulnerable to Cross-Site Scripting (XSS) via a Journal Article Title

May 24, 2022 (updated April 28, 2025)

Liferay Portal through 7.2.0 GA1 allows XSS via a journal article title to journal_article/page.jsp in journal/journal-taglib.

References

github.com/advisories/GHSA-m2gx-7pvx-3gvg
github.com/liferay/liferay-portal
github.com/liferay/liferay-portal/commit/7e063aed70f947a92bb43a4471e0c4e650fe8f7f
nvd.nist.gov/vuln/detail/CVE-2019-16147

Code Behaviors & Features

Detect and mitigate CVE-2019-16147 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →