{"id":"CVE-2011-1570","aliases":["EUVD-2011-1571","GHSA-gjpw-cmmh-976v"],"status":"published","title":"Cross-site scripting (XSS) vulnerability in Liferay Portal Community Edition (CE) 6.x before 6.0...","description":"Cross-site scripting (XSS) vulnerability in Liferay Portal Community Edition (CE) 6.x before 6.0.6 GA, when Apache Tomcat is used, allows remote authenticated users to inject arbitrary web script or HTML via a message title, a different vulnerability than CVE-2004-2030.","severity":{"version":"2.0","score":3.5,"vector":"AV:N/AC:M/Au:S/C:N/I:P/A:N","level":"low","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.01504,"percentile":0.74515,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-79"],"published":"2011-05-07T19:00:00Z","modified":"2026-06-16T23:29:38Z","products":[{"vendor":"liferay","product":"liferay_portal"}],"references":[{"url":"http://openwall.com/lists/oss-security/2011/04/08/5","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory"]},{"url":"http://openwall.com/lists/oss-security/2011/04/11/9","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory"]},{"url":"http://issues.liferay.com/browse/LPS-12628","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Vendor Advisory"]},{"url":"http://issues.liferay.com/browse/LPS-13250","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Issue Tracking","Vendor Advisory"]},{"url":"http://openwall.com/lists/oss-security/2011/03/29/1","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory"]},{"url":"http://issues.liferay.com/secure/ReleaseNote.jspa?version=10656\u0026styleName=Html\u0026projectId=10952","tags":["x_refsource_CONFIRM","x_transferred","Release Notes","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2011-1570"},{"url":"https://github.com/advisories/GHSA-gjpw-cmmh-976v"}],"sources":{"cve":[{"id":"CVE-2011-1570","description":"Cross-site scripting (XSS) vulnerability in Liferay Portal Community Edition (CE) 6.x before 6.0.6 GA, when Apache Tomcat is used, allows remote authenticated users to inject arbitrary web script or HTML via a message title, a different vulnerability than CVE-2004-2030.","status":"published","published":"2011-05-07T19:00:00Z","modified":"2024-09-16T20:58:25.098Z","updated_at":"2026-11-02T14:35:38.321377Z"}],"euvd":[{"id":"EUVD-2011-1571","description":"Cross-site scripting (XSS) vulnerability in Liferay Portal Community Edition (CE) 6.x before 6.0.6 GA, when Apache Tomcat is used, allows remote authenticated users to inject arbitrary web script or HTML via a message title, a different vulnerability than CVE-2004-2030.","status":"published","published":"2011-05-07T19:00:00Z","modified":"2024-09-16T20:58:25Z","updated_at":"2026-11-03T00:55:09.104839Z"}],"ghsa":[{"id":"GHSA-gjpw-cmmh-976v","title":"Cross-site scripting (XSS) vulnerability in Liferay Portal Community Edition (CE) 6.x before 6.0...","description":"Cross-site scripting (XSS) vulnerability in Liferay Portal Community Edition (CE) 6.x before 6.0.6 GA, when Apache Tomcat is used, allows remote authenticated users to inject arbitrary web script or HTML via a message title, a different vulnerability than CVE-2004-2030.","status":"published","published":"2022-05-13T01:25:11Z","modified":"2023-02-01T05:07:35Z","cwes":["CWE-79"],"updated_at":"2026-11-02T14:50:33.974767Z"}],"nvd":[{"id":"CVE-2011-1570","description":"Cross-site scripting (XSS) vulnerability in Liferay Portal Community Edition (CE) 6.x before 6.0.6 GA, when Apache Tomcat is used, allows remote authenticated users to inject arbitrary web script or HTML via a message title, a different vulnerability than CVE-2004-2030.","status":"published","published":"2011-05-07T19:55:01.073Z","modified":"2026-06-16T23:29:38.947Z","cvss":[{"version":"2.0","score":3.5,"vector":"AV:N/AC:M/Au:S/C:N/I:P/A:N","level":"low","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:02:08.47516Z"}]}}