Liferay Portal 6.2.0 CE GA1 Multiple XSS

This script is Copyright (C) 2014 Tenable Network Security, Inc.


Synopsis :

The remote web server contains a Java application that is affected by
multiple cross-site scripting vulnerabilities.

Description :

According to its self-reported version number, the version of Liferay
Portal running on the remote host is 6.2.0. It is, therefore,
potentially affected by the following cross-site scripting
vulnerabilities :

- Input passed from page titles is not sanitized before
it is displayed in the Recycle Bin. (OSVDB 103269)

- Input passed from user profiles is not validated before
being displayed in the Polls. (OSVDB 103270)

- Input passed from user profiles is not validated before
being displayed in the History tab. (OSVDB 103271)

- Input passed from user profiles is not validated before
displaying it to the admin. (OSVDB 103272)

- Input passed from user profiles is not validated before
being displayed in the bookmarks. (OSVDB 103273)

- Input passed from the Look and Feel dialogs is not
validated before being returned to the user.
(OSVDB 103274)

- Input when displaying search results is not validated
for various portlets. (OSVDB 103275)

- Input for scheduled publish-to-live events are not
validated before being returned to users.
(OSVDB 103276)

- Input from article titles is not validated before
being displayed in the print mode. (OSVDB 103277)

- Input from page titles, when selecting a scope for a
portlet, is not validated before being returned to the
user. (OSVDB 103278)

- Input to the title of a post priority is not validated
before being returned to the user. (OSVDB 103279)

- Input passed from page titles using the Site Map is not
validated before being returned to the user.
(OSVDB 103280)

- Input from page links in DDL is not validated before
being returned to the user. (OSVDB 103281)

These flaws could allow a remote attacker with a specially crafted
request to execute arbitrary code within the trust relationship
between the browser and server.

Note that Nessus has not tested for these issues or determined if the
patch has been applied, but has instead relied only on the
application's self-reported version number.

See also :

http://www.nessus.org/u?4a63ae3a

Solution :

Upgrade to Liferay Portal 6.2.1 or later.

Risk factor :

Medium / CVSS Base Score : 4.3
(CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N)
CVSS Temporal Score : 3.7
(CVSS2#E:ND/RL:OF/RC:C)
Public Exploit Available : true

Family: CGI abuses : XSS

Nessus Plugin ID: 73521 ()

Bugtraq ID: 65553

CVE ID: