Uploaded image for project: 'PUBLIC - Liferay Portal Enterprise Edition'
  1. PUBLIC - Liferay Portal Enterprise Edition
  2. LPE-15981

Velocity and FreeMarker templates do not properly restrict the use of some variables (6.1)

Details

    • 4

    Description

      Velocity and FreeMarker templates do not properly restrict the use of some variables.

      Velocity and FreeMarker templates does not properly restrict the use of some variables, which allow any user with permission to create a template to insert arbitrary code in any page, prevent access to the portal or access private information stored in the portal.

      "staticFieldGetter" has been added to the following portal properties:

      • journal.template.freemarker.restricted.variables
      • journal.template.velocity.restricted.variables

      https://web.liferay.com/group/customer/products/portal/security-vulnerability/lsv-335

      Attachments

        Activity

          People

            support-ee EE Support
            tibor.lipusz Tibor Lipusz
            Votes:
            0 Vote for this issue
            Watchers:
            1 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved:

              Packages

                Version Package
                6.1.X EE