CVE-2011-1502

Liferay Portal Community Edition (CE) 6.x before 6.0.6 GA, when Apache Tomcat is used, allows remote authenticated users to read arbitrary…

Medium4.0EPSS 1.8%

Published: 7 May 2011
Updated: 16 Sept 2024
Reserved: 21 Mar 2011
Assigned by: redhat

Description

Liferay Portal Community Edition (CE) 6.x before 6.0.6 GA, when Apache Tomcat is used, allows remote authenticated users to read arbitrary files via an entity declaration in conjunction with an entity reference, related to an XML External Entity (aka XXE) issue.

Timeline

2011
21 Mar 2011
21 Mar 2011
ID reserved
By redhat
7 May 201147 days later
7 May 2011· 47 days later
Published
2024
16 Sept 202413 years later
16 Sept 2024· 13 years later
Record updated

Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.

Scores

CVSS scores of CVE-2011-1502, by who scored it
Scored by	CVSS	Score	Vector
NVDNVD · Modified	2.0	Medium4.0	AV:N/AC:L/Au:S/C:P/I:N/A:N

EPSS (exploitation in 30 days): 1.8% · top 21% of all CVEs (8 Nov 2026)

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 4.0.

Weakness

Affected products

n/a
- affected n/a

References (4)

http://issues.liferay.com/browse/LPS-14927 (opens in a new tab)x_refsource_CONFIRMx_transferred
[oss-security] 20110408 Re: CVE requests : Liferay 6.0.6 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
[oss-security] 20110411 Re: CVE requests : Liferay 6.0.6 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
[oss-security] 20110329 CVE requests : Liferay 6.0.6 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2011-1502](https://cveledger.app/badge/CVE-2011-1502.svg)](https://cveledger.app/cve/CVE-2011-1502)

Record last updated 16 Sept 2024, 16:27 UTC.