CVE-2011-1570

Severity: low (CVSS 3.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.5% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2011-05-07 · updated 2026-06-16
Weakness: CWE-79

Description

Cross-site scripting (XSS) vulnerability in Liferay Portal Community Edition (CE) 6.x before 6.0.6 GA, when Apache Tomcat is used, allows remote authenticated users to inject arbitrary web script or HTML via a message title, a different vulnerability than CVE-2004-2030.

Affected products

Liferay Portal: from 6.0.0 through 6.0.5

References

http://issues.liferay.com/browse/LPS-12628
http://issues.liferay.com/browse/LPS-13250
http://issues.liferay.com/secure/ReleaseNote.jspa?version=10656&styleName=Html&projectId=10952
http://openwall.com/lists/oss-security/2011/03/29/1
http://openwall.com/lists/oss-security/2011/04/08/5
http://openwall.com/lists/oss-security/2011/04/11/9
http://issues.liferay.com/browse/LPS-12628
http://issues.liferay.com/browse/LPS-13250
http://issues.liferay.com/secure/ReleaseNote.jspa?version=10656&styleName=Html&projectId=10952
http://openwall.com/lists/oss-security/2011/03/29/1
http://openwall.com/lists/oss-security/2011/04/08/5
http://openwall.com/lists/oss-security/2011/04/11/9

Get alerted when CVE-2011-1570 or the next vulnerability affects your stack