Vulnerability Description
Cross-site scripting (XSS) vulnerability in Liferay Portal Community Edition (CE) 6.x before 6.0.6 GA, when Apache Tomcat is used, allows remote authenticated users to inject arbitrary web script or HTML via a message title, a different vulnerability than CVE-2004-2030.
CVSS Score
LOW
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Liferay | Liferay Portal | >= 6.0.0, <= 6.0.5 |
| Microsoft | Windows 7 | - |
Related Weaknesses (CWE)
References
- http://issues.liferay.com/browse/LPS-12628Issue TrackingVendor Advisory
- http://issues.liferay.com/browse/LPS-13250ExploitIssue TrackingVendor Advisory
- http://issues.liferay.com/secure/ReleaseNote.jspa?version=10656&styleName=Html&pRelease NotesVendor Advisory
- http://openwall.com/lists/oss-security/2011/03/29/1Mailing ListThird Party Advisory
- http://openwall.com/lists/oss-security/2011/04/08/5Mailing ListThird Party Advisory
- http://openwall.com/lists/oss-security/2011/04/11/9Mailing ListThird Party Advisory
- http://issues.liferay.com/browse/LPS-12628Issue TrackingVendor Advisory
- http://issues.liferay.com/browse/LPS-13250ExploitIssue TrackingVendor Advisory
- http://issues.liferay.com/secure/ReleaseNote.jspa?version=10656&styleName=Html&pRelease NotesVendor Advisory
- http://openwall.com/lists/oss-security/2011/03/29/1Mailing ListThird Party Advisory
- http://openwall.com/lists/oss-security/2011/04/08/5Mailing ListThird Party Advisory
- http://openwall.com/lists/oss-security/2011/04/11/9Mailing ListThird Party Advisory
FAQ
What is CVE-2011-1570?
CVE-2011-1570 is a vulnerability with a CVSS score of 3.5 (LOW). Cross-site scripting (XSS) vulnerability in Liferay Portal Community Edition (CE) 6.x before 6.0.6 GA, when Apache Tomcat is used, allows remote authenticated users to inject arbitrary web script or H...
How severe is CVE-2011-1570?
CVE-2011-1570 has been rated LOW with a CVSS base score of 3.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2011-1570?
Check the references section above for vendor advisories and patch information. Affected products include: Liferay Liferay Portal, Microsoft Windows 7.