Message Boards

  1. Home
  2. General
  3. Initial Security Advisories for Liferay Portal 6.1 GA1

Initial Security Advisories for Liferay Portal 6.1 GA1

thumbnail
James Falkner, modified 11 Years ago.

Initial Security Advisories for Liferay Portal 6.1 GA1

Liferay Legend Posts: 1399 Join Date: 9/17/10 Recent Posts
The following advisories have now been documented on the Known Vulnerabilities page:
  • CST-SA: LPS-28423 Delete any file on the server
  • CST-SA: LPS-26930 Reconfigure Liferay to use a remote cache
  • CST-SA: LPS-28358 SecureFilter can be bypassed
  • CST-SA: LPS-28309 Directory Traversal
  • CST-SA: LPS-26940 Users without the ASSIGN_MEMBER permission can still assign users to an organization
  • CST-SA: LPS-26935 All JSON web services are accessible without authentication.
  • CST-SA: LPS-27726 Remote code execution in Calendar portlet
This represents the currently known Severity-1 vulnerabilities for Liferay Portal 6.1 GA1. They are all fixed in the upcoming GA2 release.

Going forward, new individual vulnerabilities will be posted to this forum category, including Severity-1 and Severity-2 issues. Binary and source patches will be made available for all Severity-1 issues.
security advisories
thumbnail
Patrick Wolf, modified 11 Years ago.

RE: Initial Security Advisories for Liferay Portal 6.1 GA1

Regular Member Posts: 127 Join Date: 9/15/10 Recent Posts
That's cool. Not the security vulnerabilities but the message board post created for these issues. Thank you for that James.