Description
Cross-site scripting (XSS) vulnerability in Liferay Portal Community Edition (CE) 5.x and 6.x before 6.0.6 GA allows remote authenticated users to inject arbitrary web script or HTML via a blog title.
References
- http://issues.liferay.com/browse/LPS-11506
- [oss-security] 20110408 Re: CVE requests : Liferay 6.0.6 mailing-list
- [oss-security] 20110411 Re: CVE requests : Liferay 6.0.6 mailing-list
- http://issues.liferay.com/browse/LPS-12145
- [oss-security] 20110329 CVE requests : Liferay 6.0.6 mailing-list
- http://issues.liferay.com/secure/ReleaseNote.jspa?version=10656&styleName=Html&projectId=10952