VulnerabilityModified
CVE-2011-1503
The XSL Content portlet in Liferay Portal Community Edition (CE) 5.x and 6.x before 6.0.6 GA, when Apache Tomcat or Oracle GlassFish is used, allows remote authenticated users to read arbitrary (1) XSL and (2) XML files via a file:/// URL.
LOW 3.5EPSS 1.40%
Does this matter?
Lower severity and a low EPSS score (1.40%). Track it; it rarely justifies an emergency change on its own.
Description
The XSL Content portlet in Liferay Portal Community Edition (CE) 5.x and 6.x before 6.0.6 GA, when Apache Tomcat or Oracle GlassFish is used, allows remote authenticated users to read arbitrary (1) XSL and (2) XML files via a file:/// URL.
- CVSS 2.0
- 3.5 LOWAV:N/AC:M/Au:S/C:P/I:N/A:N
- EPSS
- 1.40% probability · 71th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-200
- Affected
- liferay/liferay portal
- Source
- secalert@redhat.com
References
- http://issues.liferay.com/browse/LPS-13762Issue Tracking, Vendor Advisory
- http://issues.liferay.com/secure/ReleaseNote.jspa?version=10656&styleName=Html&projectId=10952Issue Tracking, Release Notes, Vendor Advisory
- http://openwall.com/lists/oss-security/2011/03/29/1Mailing List, Third Party Advisory
- http://openwall.com/lists/oss-security/2011/04/08/5Mailing List, Third Party Advisory
- http://openwall.com/lists/oss-security/2011/04/11/9Mailing List, Third Party Advisory
- http://issues.liferay.com/browse/LPS-13762Issue Tracking, Vendor Advisory
- http://issues.liferay.com/secure/ReleaseNote.jspa?version=10656&styleName=Html&projectId=10952Issue Tracking, Release Notes, Vendor Advisory
- http://openwall.com/lists/oss-security/2011/03/29/1Mailing List, Third Party Advisory
- http://openwall.com/lists/oss-security/2011/04/08/5Mailing List, Third Party Advisory
- http://openwall.com/lists/oss-security/2011/04/11/9Mailing List, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.