CST-7061 Path traversal vulnerability in BaseBSFPortlet

Description

The BaseBSFPortlet class contains a path traversal vulnerability via URL manipulation.

Liferay Portal 7.0 CE does not use the BaseBSFPortlet class out of the box. However, developers extending BaseBSFPortlet may be vulnerable.

Severity

Severity 2

Notes

Liferay Portal 7.0 CE is no longer supported and no patch is available. Developers who have extended BaseBSFPortlet should no longer use this class.

Publication Date: 

January 23, 2020

Found a Bug?

If you have found, or think you have found a bug, help us to help you by letting us know!

Found a Security Vulnerability?

There's a different process available if you have a security issue to report...

Hall of Fame!

Raise your profile - report security vulnerabilities and enter the Hall of Fame!