CVE-2004-2030: Multiple cross-site scripting (XSS) vulnerabilities in index.jsp for Liferay before 2.2.0 release 10/1/2004...

Security readout for executives and security teams

CVE-2004-2030 describes multiple XSS flaws in older Liferay index.jsp handling. A remote attacker could inject script or HTML, including through a message subject. Business urgency depends on whether legacy Liferay remains exposed, especially public portals or authenticated intranets using versions before the 2004 fixed release. Exposure is most likely in legacy Liferay deployments predating 2.2.0, especially portals that render user-controlled message subjects through index.jsp. The source bundle does not provide complete product metadata or CPEs. Treat this as a legacy exposure check, not a current emergency based on the provided evidence. Prioritize if old Liferay is public-facing or handles authenticated business workflows. Mitigation focus: Inventory all Liferay deployments and identify versions older than 2.2.0 release 10/1/2004.; Check Liferay release notes and vendor guidance for the confirmed fixed version.; Upgrade or retire unsupported Liferay instances that match the affected vintage..

Prepared

Jun 29, 2026, 21:12 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.