Detections
Analytics
Liferay Portal upload_progress_poller.jsp XSS
medium Nessus Plugin ID 59360
Language:
Synopsis
The remote web server contains a Java application affected by a cross-site scripting vulnerability.Description
The version of Liferay Portal hosted on the remote web server fails to properly sanitize input to the 'uploadProgressId' parameter of the 'upload_progress_poller.jsp' script.An attacker can leverage this issue by enticing a user to follow a malicious URL, causing attacker-specified script code to run inside the user's browser in the context of the affected site. Information harvested this way may aid in launching further attacks.
Solution
Update to the newest version in Git or to 6.2.0 when it becomes available.See Also
Plugin Details
Severity: Medium
ID: 59360
File Name: liferay_lps27280_xss.nasl
Version: 1.10
Type: remote
Family: CGI abuses : XSS
Published: 6/4/2012
Updated: 4/11/2022
Configuration: Enable thorough checks
Supported Sensors: Nessus
Vulnerability Information
CPE: cpe:/a:liferay:portal
Required KB Items: www/liferay_portal
Excluded KB Items: Settings/disable_cgi_scanning
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 5/14/2012
Vulnerability Publication Date: 5/13/2012
Exploitable With
Elliot (Liferay Users disclosure)
Reference Information
BID: 53546