Lucene search

RedhatCVE-2011-1570

HistoryMay 07, 2011 - 7:55 p.m.

CVE-2011-1570

2011-05-0719:55:01

CWE-79

redhat

web.nvd.nist.gov

cve-2011-1570

cross-site scripting

xss

liferay portal

apache tomcat

nvd

CVSS2

3.5

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

AI Score

5.3

Confidence

High

EPSS

0.006

Percentile

79.5%

JSON

Cross-site scripting (XSS) vulnerability in Liferay Portal Community Edition (CE) 6.x before 6.0.6 GA, when Apache Tomcat is used, allows remote authenticated users to inject arbitrary web script or HTML via a message title, a different vulnerability than CVE-2004-2030.

Affected configurations

Nvd

Node

liferayliferay_portalRange6.0.0–6.0.5community

AND

microsoftwindows_7Match-

VendorProductVersionCPE
liferayliferay_portal*cpe:2.3:a:liferay:liferay_portal:*:*:*:*:community:*:*:*
microsoftwindows_7-cpe:2.3:o:microsoft:windows_7:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
liferay	liferay_portal	*	cpe:2.3:a:liferay:liferay_portal:::::community:::*
microsoft	windows_7	-	cpe:2.3:o:microsoft:windows_7:-:::::::*

References

issues.liferay.com/browse/LPS-12628

issues.liferay.com/browse/LPS-13250

issues.liferay.com/secure/ReleaseNote.jspa?version=10656&styleName=Html&projectId=10952

openwall.com/lists/oss-security/2011/03/29/1

openwall.com/lists/oss-security/2011/04/08/5

openwall.com/lists/oss-security/2011/04/11/9

CVSS2

3.5

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

AI Score

5.3

Confidence

High

EPSS

0.006

Percentile

79.5%

JSON

Related for CVE-2011-1570