CVE-2011-1571
Liferay Portal vulnerable to arbitrary command injection
CVE-2011-1571 is a medium vulnerability (CVSS 6.8) in Liferay Portal, published May 7, 2011. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 8.47%, the 95th percentile. Fixed in com.liferay.portal:portal-service 6.0.6-ga.
Unspecified vulnerability in the XSL Content portlet in Liferay Portal Community Edition (CE) 5.x and 6.x before 6.0.6 GA, when Apache Tomcat is used, allows remote attackers to execute arbitrary commands via unknown vectors.
Exploit likelihood
What each source reports
NVD Score used
Unspecified vulnerability in the XSL Content portlet in Liferay Portal Community Edition (CE) 5.x and 6.x before 6.0.6 GA, when Apache Tomcat is used, allows remote attackers to execute arbitrary commands via unknown vectors.
- Record
CVE-2011-1571- CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Updated
- 2026-11-02
CVE List No score
Unspecified vulnerability in the XSL Content portlet in Liferay Portal Community Edition (CE) 5.x and 6.x before 6.0.6 GA, when Apache Tomcat is used, allows remote attackers to execute arbitrary commands via unknown vectors.
- Record
CVE-2011-1571- Updated
- 2026-11-02
EUVDEUVD-2011-1572 No score
Unspecified vulnerability in the XSL Content portlet in Liferay Portal Community Edition (CE) 5.x and 6.x before 6.0.6 GA, when Apache Tomcat is used, allows remote attackers to execute arbitrary commands via unknown vectors.
- Record
EUVD-2011-1572- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-rpj9-pc39-h8j8
Liferay Portal vulnerable to arbitrary command injection
Unspecified vulnerability in the XSL Content portlet in Liferay Portal Community Edition (CE) 5.x and 6.x before 6.0.6 GA, when Apache Tomcat is used, allows remote attackers to execute arbitrary commands via unknown vectors.
- Record
GHSA-rpj9-pc39-h8j8- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N - Weakness
- CWE-77
- Updated
- 2026-11-02
OSVGHSA-rpj9-pc39-h8j8
Liferay Portal vulnerable to arbitrary command injection
Unspecified vulnerability in the XSL Content portlet in Liferay Portal Community Edition (CE) 5.x and 6.x before 6.0.6 GA, when Apache Tomcat is used, allows remote attackers to execute arbitrary commands via unknown vectors.
- Record
GHSA-rpj9-pc39-h8j8- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N - Weakness
- CWE-77
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
com.liferay.portal:portal-serviceMaven |
5.0.0 up to 6.0.6-ga | 6.0.6-ga |
com.liferay.portal:portal-serviceMaven |
5.0.0 up to 6.0.6-ga, plus listed versions 5.2.36.0.26.0.36.0.46.0.5 |
6.0.6-ga |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | Liferay XSL - Command Execution (Metasploit) | 2012-04-08 |
| PoC in GitHub | yazgx97/CVE-2011-1571 | 2019-06-13 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, Exploit-DB, GitHub Advisories, NVD, OSV, PoC in GitHub |
References
issues.liferay.com/browse/LPS-14726
openwall.com/lists/oss-security/2011/04/08/5
nvd.nist.gov/vuln/detail/CVE-2011-1571
github.com/liferay/liferay-portal/commit/55502ca16019e1ea1a581ee87f4f20cde638c825