#VU13061 Improper input validation in Liferay Enterprise Portal


Vulnerability identifier: #VU13061

Vulnerability risk: High

CVSSv4.0: 8.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: N/A

CWE-ID: CWE-20

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
Liferay Enterprise Portal
Web applications / CMS

Vendor: Liferay

Description
The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists in the Web Proxy portlet/application due to insufficient validation of user-supplied input. A remote attacker can supply specially crafted stylesheet and execute arbitrary code with elevated privileges.

Mitigation
Update to version 7.0 CE GA7 (7.0.6) or later.

Vulnerable software versions

Liferay Enterprise Portal: 7.0 CE GA6

External links
https://dev.liferay.com/web/community-security-team/known-vulnerabilities/-/asset_publisher/4AHAYapU...

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.


Latest bulletins with this vulnerability


Multiple vulnerabilities in Liferay Enterprise Portal