PT-2014-8481 · Liferay · Liferay Portal Enterprise Edition

Publicado 2014-11-24 · Atualizado 2015-08-06 · CVE-2014-8349

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Baixa

Vetor base

AV:N/AC:M/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Liferay Portal Enterprise Edition (EE) versions 6.2 SP8 and earlier

Description A cross-site scripting (XSS) issue allows remote authenticated users to inject arbitrary web script or HTML via the 20 body parameter in the comment field in an uploaded file.

Recommendations For versions 6.2 SP8 and earlier, as a temporary workaround, consider restricting access to the comment field in uploaded files until a patch is available. Avoid using the 20 body parameter in the comment field to minimize the risk of exploitation.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2014-8349

Produtos afetados

Liferay Portal Enterprise Edition

Referências · 5

• http://securitytracker.com/id/1031255 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8349 · Nota
• http://seclists.org/fulldisclosure/2014/Nov/61 · Nota
• http://packetstormsecurity.com/files/129199/Liferay-Portal-6.2-EE-SP8-Cross-Site-Scripting.html · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2014-8349 · Nota de Segurança