CVE-2011-1571
Liferay Portal vulnerable to arbitrary command injection
CVE-2011-1571 is a medium vulnerability (CVSS 6.8) in Liferay Portal, published May 7, 2011. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 8.47%, the 95th percentile. Fixed in com.liferay.portal:portal-service 6.0.6-ga.
- Severity
- 6.8 MediumCVSS 2.0, NVD
- Exploit chance
- 8.47%EPSS, 95th percentile
- Exploitation
- None known2 public exploits
- Fixed in
6.0.6-gacom.liferay.portal:portal-service +1 more
Description
Unspecified vulnerability in the XSL Content portlet in Liferay Portal Community Edition (CE) 5.x and 6.x before 6.0.6 GA, when Apache Tomcat is used, allows remote attackers to execute arbitrary commands via unknown vectors.
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
com.liferay.portal:portal-serviceMaven | 5.0.0 up to 6.0.6-ga | 6.0.6-ga |
com.liferay.portal:portal-serviceMaven | 5.0.0 up to 6.0.6-ga, plus listed versions 5.2.36.0.26.0.36.0.46.0.5 | 6.0.6-ga |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | Liferay XSL - Command Execution (Metasploit) | 2012-04-08 |
| PoC in GitHub | yazgx97/CVE-2011-1571 | 2019-06-13 |
What each source reports
NVD Score used
Unspecified vulnerability in the XSL Content portlet in Liferay Portal Community Edition (CE) 5.x and 6.x before 6.0.6 GA, when Apache Tomcat is used, allows remote attackers to execute arbitrary commands via unknown vectors.
- Record
CVE-2011-1571- CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Updated
- 2026-11-02
CVE ListNo score
Unspecified vulnerability in the XSL Content portlet in Liferay Portal Community Edition (CE) 5.x and 6.x before 6.0.6 GA, when Apache Tomcat is used, allows remote attackers to execute arbitrary commands via unknown vectors.
- Record
CVE-2011-1571- Updated
- 2026-11-02
EUVDEUVD-2011-1572No score
Unspecified vulnerability in the XSL Content portlet in Liferay Portal Community Edition (CE) 5.x and 6.x before 6.0.6 GA, when Apache Tomcat is used, allows remote attackers to execute arbitrary commands via unknown vectors.
- Record
EUVD-2011-1572- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-rpj9-pc39-h8j8
Liferay Portal vulnerable to arbitrary command injection
Unspecified vulnerability in the XSL Content portlet in Liferay Portal Community Edition (CE) 5.x and 6.x before 6.0.6 GA, when Apache Tomcat is used, allows remote attackers to execute arbitrary commands via unknown vectors.
- Record
GHSA-rpj9-pc39-h8j8- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N - Weakness
- CWE-77
- Updated
- 2026-11-02
OSVGHSA-rpj9-pc39-h8j8
Liferay Portal vulnerable to arbitrary command injection
Unspecified vulnerability in the XSL Content portlet in Liferay Portal Community Edition (CE) 5.x and 6.x before 6.0.6 GA, when Apache Tomcat is used, allows remote attackers to execute arbitrary commands via unknown vectors.
- Record
GHSA-rpj9-pc39-h8j8- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N - Weakness
- CWE-77
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD, OSV, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
issues.liferay.com/browse/LPS-14726
openwall.com/lists/oss-security/2011/04/08/5
nvd.nist.gov/vuln/detail/CVE-2011-1571
github.com/liferay/liferay-portal/commit/55502ca16019e1ea1a581ee87f4f20cde638c825