Vulnerability CVE-2011-1504
Published: 2011-05-07   Modified: 2012-02-13

Description:
Cross-site scripting (XSS) vulnerability in Liferay Portal Community Edition (CE) 5.x and 6.x before 6.0.6 GA allows remote authenticated users to inject arbitrary web script or HTML via a blog title.

Type:

CWE-79

 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'))

CVSS2 => (AV:N/AC:M/Au:S/C:N/I:P/A:N)

CVSS Base Score
Impact Subscore
Exploitability Subscore
3.5/10
2.9/10
6.8/10
Exploit range
Attack complexity
Authentication
Remote
Medium
Single time
Confidentiality impact
Integrity impact
Availability impact
None
Partial
None
Affected software
Liferay -> Portal 

 References:
http://openwall.com/lists/oss-security/2011/04/11/9
http://openwall.com/lists/oss-security/2011/04/08/5
http://openwall.com/lists/oss-security/2011/03/29/1
http://issues.liferay.com/secure/ReleaseNote.jspa?version=10656&styleName=Html&projectId=10952
http://issues.liferay.com/browse/LPS-12145
http://issues.liferay.com/browse/LPS-11506
Copyright 2024, cxsecurity.com

 

Back to Top