Description

The XSL Content portlet in Liferay Portal Community Edition (CE) 5.x and 6.x before 6.0.6 GA, when Apache Tomcat or Oracle GlassFish is used, allows remote authenticated users to read arbitrary (1) XSL and (2) XML files via a file:/// URL.

Remediation

References

CVE-2011-1503

Related Vulnerabilities

Zope Web Application Server Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') Vulnerability (CVE-2012-5507)

WordPress Plugin Patreon WordPress Multiple Cross-Site Scripting Vulnerabilities (1.7.1)

SharePoint Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2020-0973)

Moodle Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2012-4403)

WordPress Plugin GS Filterable Portfolio Cross-Site Scripting (1.6.0)

Severity

Low

Tags

Missing Update Known Vulnerabilities CWE-200 CVE-2011-1503