VulnerabilityModified

CVE-2011-1570

Cross-site scripting (XSS) vulnerability in Liferay Portal Community Edition (CE) 6.x before 6.0.6 GA, when Apache Tomcat is used, allows remote authenticated users to inject arbitrary web script or HTML via a message title, a different vulnerability…

LOW 3.5EPSS 1.50%

Does this matter?

Lower severity and a low EPSS score (1.50%). Track it; it rarely justifies an emergency change on its own.

Description

CVSS 2.0: 3.5 LOWAV:N/AC:M/Au:S/C:N/I:P/A:N
EPSS: 1.50% probability · 73th percentile
CISA KEV: Not listed
Weakness: CWE-79
Affected: liferay/liferay portal
Source: secalert@redhat.com

References

http://issues.liferay.com/browse/LPS-12628Issue Tracking, Vendor Advisory
http://issues.liferay.com/browse/LPS-13250Exploit, Issue Tracking, Vendor Advisory
http://issues.liferay.com/secure/ReleaseNote.jspa?version=10656&styleName=Html&projectId=10952Release Notes, Vendor Advisory
http://openwall.com/lists/oss-security/2011/03/29/1Mailing List, Third Party Advisory
http://openwall.com/lists/oss-security/2011/04/08/5Mailing List, Third Party Advisory
http://openwall.com/lists/oss-security/2011/04/11/9Mailing List, Third Party Advisory
http://issues.liferay.com/browse/LPS-12628Issue Tracking, Vendor Advisory
http://issues.liferay.com/browse/LPS-13250Exploit, Issue Tracking, Vendor Advisory
http://issues.liferay.com/secure/ReleaseNote.jspa?version=10656&styleName=Html&projectId=10952Release Notes, Vendor Advisory
http://openwall.com/lists/oss-security/2011/03/29/1Mailing List, Third Party Advisory
http://openwall.com/lists/oss-security/2011/04/08/5Mailing List, Third Party Advisory
http://openwall.com/lists/oss-security/2011/04/11/9Mailing List, Third Party Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.