Uploaded image for project: 'PUBLIC - Liferay Portal Enterprise Edition'
  1. PUBLIC - Liferay Portal Enterprise Edition
  2. LPE-15981

Velocity and FreeMarker templates do not properly restrict the use of some variables (6.1)

    Details

    • Business Value:
      4

      Description

      Velocity and FreeMarker templates do not properly restrict the use of some variables.

      Velocity and FreeMarker templates does not properly restrict the use of some variables, which allow any user with permission to create a template to insert arbitrary code in any page, prevent access to the portal or access private information stored in the portal.

      "staticFieldGetter" has been added to the following portal properties:

      • journal.template.freemarker.restricted.variables
      • journal.template.velocity.restricted.variables

      https://web.liferay.com/group/customer/products/portal/security-vulnerability/lsv-335

        Attachments

          Activity

            People

            Assignee:
            support-ee EE Support
            Reporter:
            tibor.lipusz Tibor Lipusz
            Votes:
            0 Vote for this issue
            Watchers:
            1 Start watching this issue

              Dates

              Created:
              Updated:
              Resolved:

                Packages

                Version Package
                6.1.X EE