xss vulnerability in upload_progress_poller

• Type: Bug
• Status: Closed
• Resolution: Fixed
• Affects Version/s: 6.1.0 CE GA1, 6.1.10 EE GA1, 6.2.0 CE M2
• Fix Version/s: 6.0.X EE, 6.1.1 CE GA2, 6.1.20 EE GA2, --Sprint 11/12, 6.2.0 CE M2
• Component/s: Accessibility, Security Vulnerability
• Labels:
  • QA-R
• Environment:
  Hide

  Tomcat 6.0 + MySQL 5. Portal 6.0.x GIT ID: d2adf8c190bbe292476aaaa921f04eb17d21bafb. ; Tomcat 7.0 + MySQL 5. Portal 6.1.x EE GIT ID: 652d89f693d1542282073b84612b83c739c63692. ; Tomcat 7.0 + MySQL 5. Portal 6.2.x GIT ID: e8fe4e7b06ddf499c700aaebc5902363233c2b26.

  Show

  Tomcat 6.0 + MySQL 5. Portal 6.0.x GIT ID: d2adf8c190bbe292476aaaa921f04eb17d21bafb. Tomcat 7.0 + MySQL 5. Portal 6.1.x EE GIT ID: 652d89f693d1542282073b84612b83c739c63692. Tomcat 7.0 + MySQL 5. Portal 6.2.x GIT ID: e8fe4e7b06ddf499c700aaebc5902363233c2b26.
• Branch Version/s:
  6.1.x, 6.0.x
• Backported to Branch:
  Committed
• Fix Priority: 3
• Git Pull Request: https://github.com/brianchandotcom/liferay-portal/pull/5284

Login with the URL:

http://localhost:8080/html/portal/upload_progress_poller.jsp?uploadProgressId=a%3D1%3Balert(document.cookie)%3B%2F%2F