CVE-2011-1503: Liferay Portal

Low severity, CVSS 3.5. EPSS: 1.4% chance of exploitation in the next 30 days.

The XSL Content portlet in Liferay Portal Community Edition (CE) 5.x and 6.x before 6.0.6 GA, when Apache Tomcat or Oracle GlassFish is used, allows remote authenticated users to read arbitrary (1) XSL and (2) XML files via a file:/// URL.

Affected products

• Liferay Liferay Portal: from 5.1.0, up to and including 5.1.2; from 5.2.0, up to and including 5.2.3; from 6.0.0, up to and including 6.0.5

Published 2011-05-07. Last modified 2026-06-16.