XSS in wiki portlet

• Type: Bug
• Status: Closed
• Resolution: Fixed
• Affects Version/s: 6.1.30 EE GA3, 6.2.0 CE B1
• Fix Version/s: 6.1.2 CE GA3, 6.1.30 EE GA3, 6.1.X EE, 6.2.0 CE B1
• Component/s: Security Vulnerability
• Labels:
  • QA-R
  • pc_30
• Environment:
  Hide

  Tomcat 7.0 + MySQL 5. Portal ee-6.1.30 GIT ID: 009a56d4f746338e50b49eb6c4e944eefdb96720; Tomcat 7.0 + MySQL 5. Portal 6.1.x EE GIT ID: c0fe992684a7d09a825141a57662493a632bb42f.; Tomcat 7.0 + MySQL 5. Portal 6.2.x GIT ID: 0a25ff2cbb580ca142173ccfe1f9308f2529f454.

  Show

  Tomcat 7.0 + MySQL 5. Portal ee-6.1.30 GIT ID: 009a56d4f746338e50b49eb6c4e944eefdb96720 Tomcat 7.0 + MySQL 5. Portal 6.1.x EE GIT ID: c0fe992684a7d09a825141a57662493a632bb42f. Tomcat 7.0 + MySQL 5. Portal 6.2.x GIT ID: 0a25ff2cbb580ca142173ccfe1f9308f2529f454.
• Branch Version/s:
  6.1.x
• Backported to Branch:
  Committed
• Story Points: 5
• Fix Priority: 4
• Git Pull Request: https://github.com/brianchandotcom/liferay-portal/pull/12463

1. Go to Control Panel/Wiki.
2. Click Add Wiki button.
3. Fill title: <script>alert("xss")</script>.
4. Save

Expected result:
Users able to create wiki page.

Actual result:
XSS appear