CVE-2011-1503

2022-10-0316:15:10

CWE-200

[email protected]

web.nvd.nist.gov

cve-2011-1503

liferay portal

xsl content portlet

apache tomcat

oracle glassfish

file:/// url

security vulnerability

3.5 Low

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:S/C:P/I:N/A:N

6.2 Medium

AI Score

Confidence

Low

0.002 Low

EPSS

Percentile

51.8%

JSON

The XSL Content portlet in Liferay Portal Community Edition (CE) 5.x and 6.x before 6.0.6 GA, when Apache Tomcat or Oracle GlassFish is used, allows remote authenticated users to read arbitrary (1) XSL and (2) XML files via a file:/// URL.

Affected configurations

NVD

Node

liferayliferay_portalRange5.1.0–5.1.2community

liferayliferay_portalRange5.2.0–5.2.3community

liferayliferay_portalRange6.0.0–6.0.5community

AND

linuxlinux_kernelMatch-

microsoftwindows_7Match-

CPENameOperatorVersion
liferay:liferay_portalliferay liferay portalle5.1.2
liferay:liferay_portalliferay liferay portalle5.2.3
liferay:liferay_portalliferay liferay portalle6.0.5

CPE	Name	Operator	Version
liferay:liferay_portal	liferay liferay portal	le	5.1.2
liferay:liferay_portal	liferay liferay portal	le	5.2.3
liferay:liferay_portal	liferay liferay portal	le	6.0.5