Uploaded image for project: 'PUBLIC - Liferay Portal Enterprise Edition'
  1. PUBLIC - Liferay Portal Enterprise Edition
  2. LPE-15981

Velocity and FreeMarker templates do not properly restrict the use of some variables (6.1)

    Details

    • Business Value:
      4

      Description

      Velocity and FreeMarker templates do not properly restrict the use of some variables.

      Velocity and FreeMarker templates does not properly restrict the use of some variables, which allow any user with permission to create a template to insert arbitrary code in any page, prevent access to the portal or access private information stored in the portal.

      "staticFieldGetter" has been added to the following portal properties:

      • journal.template.freemarker.restricted.variables
      • journal.template.velocity.restricted.variables

      https://web.liferay.com/group/customer/products/portal/security-vulnerability/lsv-335

        Attachments

          Activity

            People

            • Assignee:
              support-ee EE Support
              Reporter:
              tibor.lipusz Tibor Lipusz
            • Votes:
              0 Vote for this issue
              Watchers:
              1 Start watching this issue

              Dates

              • Created:
                Updated:
                Resolved:

                Packages

                Version Package
                6.1.X EE