Description

The XSL Content portlet in Liferay Portal Community Edition (CE) 5.x and 6.x before 6.0.6 GA, when Apache Tomcat or Oracle GlassFish is used, allows remote authenticated users to read arbitrary (1) XSL and (2) XML files via a file:/// URL.

Remediation

References

CVE-2011-1503

Related Vulnerabilities

WordPress Plugin FL3R FeelBox Multiple Vulnerabilities (8.1)

WordPress Plugin Essential Blocks-Page Builder Gutenberg Blocks, Patterns & Templates Multiple PHP Object Injection Vulnerabilities (4.2.0)

Drupal Other Vulnerability (CVE-2006-1227)

IBM RTC Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2021-20350)

WordPress Plugin aoringo CAT setter Cross-Site Scripting (0.1.1)

Severity

Low

Classification

CVE-2011-1503 CWE-200

Tags

Missing Update Known Vulnerabilities