Community Security Team

The Liferay Community Security Team is an all-volunteer group of community members who manage security issues related to Liferay Portal.

The Liferay Community Security Team pages have moved to the Liferay Developer Network - Community Security Team. Please update your bookmarks, as this page will eventually be removed.

Known Vulnerabilities

The following vulnerabilities are known to exist in Liferay Portal CE.  Users of older releases are strongly encouraged to upgrade to the latest Liferay Portal CE release.  Patches are only produced for the latest Liferay Portal CE release.  Source code modifications may be possible on older releases, but care must be taken to backport fixes that may not apply to older releases.

To obtain source or binary patches for each of the vulnerabilities, click on the name of the vulnerability, and look for links for source and binary patches.  To obtain a single cumulative source or binary patch for all known vulnerabilities, visit the Patch Details section of the CST Process page.  Note that the availability of the single cumulative binary patch may lag a day or two behind availability of the associated source patches.  

Quick Links

« Back

CST-SA: LPS-45661 Various XSS issues in 6.2.1

Date

Wed, 23 Apr 2014 13:25:27 +0000

Title

CST-SA: LPS-45661 Various XSS issues in 6.2.1

Description

  • LPS-44182 Reflected XSS in edit layout
  • LPS-44196 Stored XSS in Asset Publisher and WCM Display portlets via OpenOffice conversion file extensions
  • LPS-44197 Reflected XSS in *Directory portlets using tabs1Names parameter
  • LPS-44200 Reflected XSS in Trash using renameMessage, overrideMessage and oldName params
  • LPS-42688 Stored XSS issues via portlet Look&Feel screen
  • LPS-42713 Stored XSS in Layout CSS
  • LPS-43043 XSS using Theme configuration
  • LPS-43362 XSS with Page Variation History
  • LPS-43477 XSS in FileEntry and Folder title
  • LPS-43496 XSS in search configuration
  • LPS-43508 XSS in WCM title preview & Trash model title
  • LPS-43615 XSS in DocLib repository
  • LPS-43617 Reflected XSS in DocLib & Journal entryColumns and displayViews params
  • LPS-43619 XSS in DDM Structures - defaultLanguage
  • LPS-43647 Reflected XSS in Group Statistics
  • LPS-43649 Several XSS in Journal
  • LPS-43658 Stored and reflected XSS in Mobile Device Rules
  • LPS-43659 XSS in LDAP group import test
  • LPS-43664 Reflected XSS in roles admin
  • LPS-43811 Stored & Reflected XSS via SessionClickAction
  • LPS-43839 XSS in Public render parameters configuration
  • LPS-41075 XSS problem on repository

Severity

Severity 2

Workaround

None.

Issue Links

Note that some or all of these may not yet be accessible. The CST remains committed to full disclosure of all security issues once fully resolved.

Patching Instructions

See the Community Security Team Process page for details on working with source and binary patches.

Binary Patch Links

Note: The below links point to a download page which contains multiple binary patches with the following naming scheme: <Liferay-Version>-security-<patch-version>.zip. Be sure to use the latest patch for your Liferay release!

Note: Binary patches only apply to the release with which this issue is associated. Applying a binary patch to any other release will probably result in a broken install!

Source Patch Links

Note that source patches only apply to the release with which this issue is associated. Applying a source patch to any other release will probably result in a broken install! For Github URLs suffixed with .patch, removing this suffix will yield a graphical view of the patch

Credit

These issues were discovered and reported by Tomas Polesovsky, Samuel Kong, and Mark Jin