Remote command execution in portlet "XSL content"

• Type: Bug
• Status: Closed
• Resolution: Fixed
• Affects Version/s: 6.0.5 GA
• Fix Version/s: --Sprint - SP, 6.0.6 GA, --Sprint 12/11, 6.1.0 CE RC1
• Component/s: Accessibility, Content Display Widgets > XSL Content widget, Security Vulnerability, WCM > Util
• Labels: None
• Environment: Liferay 6.0.5 bundled with Tomcat, under Linux Ubuntu 10.04 LTS
• Branch Version/s:
  6.0.x, 5.1.x
• Backported to Branch:
  Committed

Given the impact of this security bug, I prefer not to disclose details on a public bug tracker. Please set this ticket to 'private' or ask for details by email. My public GPG key is available online : http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x0F7F7D6325E7DDEA