CVE-2011-1570: XSS
First published: Sat May 07 2011(Updated: )
Cross-site scripting (XSS) vulnerability in Liferay Portal Community Edition (CE) 6.x before 6.0.6 GA, when Apache Tomcat is used, allows remote authenticated users to inject arbitrary web script or HTML via a message title, a different vulnerability than CVE-2004-2030.
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Liferay 7.4 GA | >=6.0.0<=6.0.5 | |
| Microsoft Windows 7 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://issues.liferay.com/browse/LPS-13250
- http://issues.liferay.com/browse/LPS-12628
- http://openwall.com/lists/oss-security/2011/04/11/9
- http://issues.liferay.com/secure/ReleaseNote.jspa?version=10656&styleName=Html&projectId=10952
- http://openwall.com/lists/oss-security/2011/04/08/5
- http://openwall.com/lists/oss-security/2011/03/29/1
Frequently Asked Questions
What is the severity of CVE-2011-1570?
CVE-2011-1570 has been categorized as a moderate severity Cross-site scripting (XSS) vulnerability.
How do I fix CVE-2011-1570?
To fix CVE-2011-1570, upgrade Liferay Portal Community Edition to version 6.0.6 GA or later.
Who is affected by CVE-2011-1570?
Remote authenticated users of Liferay Portal Community Edition 6.x prior to 6.0.6 GA are affected by CVE-2011-1570.
What type of vulnerability is CVE-2011-1570?
CVE-2011-1570 is a Cross-site scripting (XSS) vulnerability that allows injection of arbitrary web scripts or HTML.
What versions of Liferay Portal are vulnerable to CVE-2011-1570?
Liferay Portal Community Edition versions 6.0.0 to 6.0.5 are vulnerable to CVE-2011-1570.
- collector/nvd-historical
- agent/references
- agent/type
- agent/softwarecombine
- agent/author
- agent/severity
- agent/weakness
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/first-publish-date
- agent/event
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/liferay
- canonical/liferay 7.4 ga
- version/liferay 7.4 ga/6.0.0
- version/liferay 7.4 ga/6.0.5
- vendor/microsoft
- canonical/microsoft windows 7