Foren

Initial Security Advisories for Liferay Portal 6.1 GA1

thumbnail
James Falkner, geändert vor 11 Jahren.

Initial Security Advisories for Liferay Portal 6.1 GA1

Liferay Legend Beiträge: 1399 Beitrittsdatum: 17.09.10 Neueste Beiträge
The following advisories have now been documented on the Known Vulnerabilities page:
  • CST-SA: LPS-28423 Delete any file on the server
  • CST-SA: LPS-26930 Reconfigure Liferay to use a remote cache
  • CST-SA: LPS-28358 SecureFilter can be bypassed
  • CST-SA: LPS-28309 Directory Traversal
  • CST-SA: LPS-26940 Users without the ASSIGN_MEMBER permission can still assign users to an organization
  • CST-SA: LPS-26935 All JSON web services are accessible without authentication.
  • CST-SA: LPS-27726 Remote code execution in Calendar portlet
This represents the currently known Severity-1 vulnerabilities for Liferay Portal 6.1 GA1. They are all fixed in the upcoming GA2 release.

Going forward, new individual vulnerabilities will be posted to this forum category, including Severity-1 and Severity-2 issues. Binary and source patches will be made available for all Severity-1 issues.
thumbnail
Patrick Wolf, geändert vor 11 Jahren.

RE: Initial Security Advisories for Liferay Portal 6.1 GA1

Regular Member Beiträge: 127 Beitrittsdatum: 15.09.10 Neueste Beiträge
That's cool. Not the security vulnerabilities but the message board post created for these issues. Thank you for that James.