Description
In Liferay Portal 7.0 CE GA3, Velocity and FreeMarker templates does not properly restrict the use of some variables, which allow any user with permission to create a template to insert arbitrary code in any page, prevent access to the portal or access private information stored in the portal.
Workaround:
- Navigate to Control Panel > Configuration > System Settings > Foundation > Velocity Engine
- Add "staticFieldGetter" (without the quotes) to the list of Restricted variables
- Navigate to Control Panel > Configuration > System Settings > Foundation > FreeMarker Engine
- Add "staticFieldGetter" (without the quotes) to the list of Restricted variables
Severity
Severity 1
Fixed Version(s)
Acknowledgments
This issue was reported by Sergej Michel
Publication date: Mon, 07 Aug 2017 08:09:00 +0000