Skip to:

  1. Skip to Jira Navigation
  2. Skip to Side Navigation
  3. Skip to Main Content

Path manipulation may lead to remote code execution

Description

Some functionalities let authenticated Power Users to create arbitrary files with arbitrary extensions.

Let us know the best way to report this issue

Environment

The vulnerability was tested on Liferay 4.x It could

Activity

Show:

JR HounJuly 21, 2010 at 3:28 PM

Thanks KC / Amos!

KC OniasJuly 21, 2010 at 3:27 PM

per my discussion with Amos, this has been fixed by http://issues.liferay.com/browse/LPS-3399 and cannot be reproduced on 6.0.4

Minded Security S.r.l.June 15, 2010 at 3:41 PM

Details about this issue can be found here:

http://www.mindedsecurity.com/MSA261009.html

Fixed

Details

Assignee

Reporter

Components

Fix versions

Priority

Zendesk Support

Created May 12, 2010 at 4:12 AM
Updated June 23, 2023 at 8:57 PM
Resolved July 21, 2010 at 3:27 PM
Loading...