PT-2014-8481 · Liferay · Liferay Portal Enterprise Edition

Published 2014-11-24 · Updated 2015-08-06 · CVE-2014-8349

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Low

Base vector

AV:N/AC:M/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Liferay Portal Enterprise Edition (EE) versions 6.2 SP8 and earlier

Description A cross-site scripting (XSS) issue allows remote authenticated users to inject arbitrary web script or HTML via the 20 body parameter in the comment field in an uploaded file.

Recommendations For versions 6.2 SP8 and earlier, as a temporary workaround, consider restricting access to the comment field in uploaded files until a patch is available. Avoid using the 20 body parameter in the comment field to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2014-8349

Affected Products

Liferay Portal Enterprise Edition

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2014-8349 · Security Note
• http://securitytracker.com/id/1031255 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8349 · Note
• http://seclists.org/fulldisclosure/2014/Nov/61 · Note
• http://packetstormsecurity.com/files/129199/Liferay-Portal-6.2-EE-SP8-Cross-Site-Scripting.html · Note