[LPS-14726] Remote command execution in portlet "XSL content" - Liferay Issues

XML

Word

Printable

Details

Type: Bug
Status: Closed
Resolution: Fixed
Affects Version/s: 6.0.5 GA
Fix Version/s: --Sprint - SP, 6.0.6 GA, --Sprint 12/11, 6.1.0 CE RC1
Component/s: Accessibility, Content Display Widgets > XSL Content widget, Security Vulnerability, ~[Archived] WCM > Util
Labels:
None
Environment:
Liferay 6.0.5 bundled with Tomcat, under Linux Ubuntu 10.04 LTS

Branch Version/s:

6.0.x, 5.1.x
Backported to Branch:

Committed

Description

Given the impact of this security bug, I prefer not to disclose details on a public bug tracker. Please set this ticket to 'private' or ask for details by email. My public GPG key is available online : http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x0F7F7D6325E7DDEA

Attachments

Issue Links

relates

LPE-4194 XSL Content portlet allows execution of code on server

Closed

Activity

People

Assignee:: Samuel Kong

Reporter:: Nicolas Gregoire (Inactive)

Participants of an Issue:: Cynthia Wilburn, Michael Hashimoto, Nicolas Gregoire, Samuel Kong, Vicki Tsang, Will Vincent

Recent user:: Marta Elicegui

Votes:: 2 Vote for this issue

Watchers:: 4 Start watching this issue

Dates

Created:: 12/Jan/11 1:14 PM

Updated:: 07/Apr/20 4:59 AM

Resolved:: 27/Jan/11 5:21 PM

Days since last comment:: 10 years, 16 weeks, 2 days ago

Packages

Version	Package
--Sprint - SP
6.0.6 GA
--Sprint 12/11
6.1.0 CE RC1