CVEvulnerability
CVE-2011-1502
4.0 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2011-05-07
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 4.0 MEDIUM — AV:N/AC:L/Au:S/C:P/I:N/A:N
- Weaknesses
- CWE-200
Description
Liferay Portal Community Edition (CE) 6.x before 6.0.6 GA, when Apache Tomcat is used, allows remote authenticated users to read arbitrary files via an entity declaration in conjunction with an entity reference, related to an XML External Entity (aka XXE) issue.
Affected configurations
• liferay liferay portal (>= 6.0.0 <= 6.0.5)
Related
Weakness · CWE (1)
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness
References
- http://issues.liferay.com/browse/LPS-14927 Issue Tracking, Vendor Advisory
- http://openwall.com/lists/oss-security/2011/03/29/1 Mailing List, Third Party Advisory
- http://openwall.com/lists/oss-security/2011/04/08/5 Mailing List, Third Party Advisory
- http://openwall.com/lists/oss-security/2011/04/11/9 Mailing List, Third Party Advisory
- http://issues.liferay.com/browse/LPS-14927 Issue Tracking, Vendor Advisory
- http://openwall.com/lists/oss-security/2011/03/29/1 Mailing List, Third Party Advisory
- http://openwall.com/lists/oss-security/2011/04/08/5 Mailing List, Third Party Advisory
- http://openwall.com/lists/oss-security/2011/04/11/9 Mailing List, Third Party Advisory