Executive Summary
This Alert is flagged as TOP 25 Common Weakness Enumeration from CWE/SANS. For more information, you can read this.
Summary | |
---|---|
Title | Liferay Portal p_p_id parameter vulnerable to persistent cross-site scripting |
Informations | |||
---|---|---|---|
Name | VU#750796 | First vendor Publication | 2010-01-05 |
Vendor | VU-CERT | Last vendor Modification | 2010-01-05 |
Severity (Vendor) | N/A | Revision | M |
Security-Database Scoring CVSS v3
Cvss vector : N/A | |||
---|---|---|---|
Overall CVSS Score | NA | ||
Base Score | NA | Environmental Score | NA |
impact SubScore | NA | Temporal Score | NA |
Exploitabality Sub Score | NA | ||
Calculate full CVSS 3.0 Vectors scores |
Security-Database Scoring CVSS v2
Cvss vector : (AV:N/AC:M/Au:N/C:N/I:P/A:N) | |||
---|---|---|---|
Cvss Base Score | 4.3 | Attack Range | Network |
Cvss Impact Score | 2.9 | Attack Complexity | Medium |
Cvss Expoit Score | 8.6 | Authentication | None Required |
Calculate full CVSS 2.0 Vectors scores |
Detail
Vulnerability Note VU#750796Liferay Portal p_p_id parameter vulnerable to persistent cross-site scriptingOverviewLiferay Portal is vulnerable to persistent cross-site scripting via the p_p_id parameter, which can allow a remote, unauthenticated attacker to execute arbitrary script in the context of the portal administrator.I. DescriptionLiferay Portal is a web portal that can provide Java applets that adhere to the JSR 168 portlet specification. Liferay is available as a free community-supported version and also a commercial enterprise version. Liferay Portal fails to properly sanitize data that is provided by the p_p_id parameter, which can be provided without authentication as part of an HTTP GET request. The provided data is placed into a database, where it can be displayed to an administrator in another page, such as the Plugins Configuration section of the Control Panel. This allows for persistent cross-site scripting (XSS).II. ImpactA remote, unauthenticated attacker may be able to execute arbitrary script in the context of the portal administrator.III. SolutionApply an updateThis issue is addressed in Liferay Portal 5.3.0. Please see Liferay issue LPS-6034 for more details.
References
Thanks to Tomasz Kuczynski for reporting this vulnerability. This document was written by Will Dormann.
|
Original Source
Url : http://www.kb.cert.org/vuls/id/750796 |
CWE : Common Weakness Enumeration
% | Id | Name |
---|---|---|
100 % | CWE-79 | Failure to Preserve Web Page Structure ('Cross-site Scripting') (CWE/SANS Top 25) |
CPE : Common Platform Enumeration
Open Source Vulnerability Database (OSVDB)
Id | Description |
---|---|
61511 | Liferay Portal Control Panel Plugins Configuration p_p_id Parameter XSS |