Script injection vulnerability

• Type: Bug
• Status: Closed
• Resolution: Duplicate
• Affects Version/s: 5.2.3
• Fix Version/s: None
• Component/s: Accessibility, Security Vulnerability
• Labels: None
• Environment: lportal 5.2.3 on any system, client A-grade browser ( IE, FF)

This URL
http://localhost:8080/web/guest?p_p_id=something&p_p_lifecycle=0&p_p_state=normal&p_p_mode=view&_82_struts_action=%2Flanguage%2Fview&languageId=1//--%3E%3C/script%3E%3CScRiPt%20%0D%0A%3Ealert%28%27Hacked%27%29%3B%3C/ScRiPt%3E%22

cause excecution of Javascript in URL - 404 page shows URL unsanitized. Thought on the first view it is not a big issue this way is possible to send malicious URL by email and inject bad script and content to page.