The hook
Liferay Portal often backs intranet, customer, and partner portals where authenticated users may have authoring permissions. CVE-2010-5327 affects Liferay Portal through 6.2.10 when template-engine access controls allow privileged template behavior.
How it works
This active check confirms whether user-controlled input or workflow behavior crosses a security boundary. Public docs keep the explanation high-level so customers understand the risk. For check-specific questions about exact detection heuristics, active payload details, or source-code rule patterns, contact support@fixvibe.app.
The blast radius
If an affected Liferay Portal runtime is deployed and an untrusted authenticated user can create or edit Velocity or FreeMarker templates, the template boundary may cross into server-side command execution. A version match should drive runtime patch verification and permission review before it is treated as confirmed compromise.
// what fixvibe checks
What FixVibe checks
FixVibe checks this class with verified-domain active testing that is bounded, non-destructive, and evidence-driven. Public reports describe the affected surface and remediation. For check-specific questions about exact detection heuristics, active payload details, or source-code rule patterns, contact support@fixvibe.app.
Ironclad defenses
Apply Liferay's LPS-64547 binary/source patch for the deployed 6.2 CE release line, confirm an equivalent backport, or upgrade to a supported fixed release. Restrict template editing to trusted administrators, review existing templates, and keep portal administration behind trusted-network or authenticated access while rollout completes.