7.0.58
8 years ago
18 days ago
Known vulnerabilities in the com.liferay:com.liferay.portal.template.freemarker package. This does not include vulnerabilities belonging to this package’s dependencies.
Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for freeVulnerability | Vulnerable Version |
---|---|
com.liferay:com.liferay.portal.template.freemarker is a Liferay Portal Template FreeMarker Affected versions of this package are vulnerable to Deserialization of Untrusted Data. Liferay Portal allows man-in-the-middle attackers to execute arbitrary code via crafted serialized payloads, because of insecure deserialization. How to fix Deserialization of Untrusted Data? Upgrade | [6.0.1,6.0.7)[,5.0.23) |
com.liferay:com.liferay.portal.template.freemarker is a Liferay Portal Template FreeMarker Affected versions of this package are vulnerable to Remote Code Execution (RCE). The template API does not restrict user access to sensitive objects, which allows remote authenticated users to execute arbitrary code via crafted FreeMarker and Velocity templates. How to fix Remote Code Execution (RCE)? Upgrade | [,3.0.37)[4.0.0,4.0.28)[5.0.0,5.0.23)[6.0.1,6.0.7) |