概要
Liferay Portal often backs intranet, customer, and partner portals where authenticated users may have authoring permissions. CVE-2010-5327 affects Liferay Portal through 6.2.10 when template-engine access controls allow privileged template behavior.
仕組み
This active check confirms whether user-controlled input or workflow behavior crosses a security boundary. Public docs keep the explanation high-level so customers understand the risk. For check-specific questions about exact detection heuristics, active payload details, or source-code rule patterns, contact support@fixvibe.app.
被害範囲
If an affected Liferay Portal runtime is deployed and an untrusted authenticated user can create or edit Velocity or FreeMarker templates, the template boundary may cross into server-side command execution. A version match should drive runtime patch verification and permission review before it is treated as confirmed compromise.
// fixvibeのチェック内容
FixVibeのチェック内容
FixVibe checks this class with verified-domain active testing that is bounded, non-destructive, and evidence-driven. Public reports describe the affected surface and remediation. For check-specific questions about exact detection heuristics, active payload details, or source-code rule patterns, contact support@fixvibe.app.
鉄壁の防御
Apply Liferay's LPS-64547 binary/source patch for the deployed 6.2 CE release line, confirm an equivalent backport, or upgrade to a supported fixed release. Restrict template editing to trusted administrators, review existing templates, and keep portal administration behind trusted-network or authenticated access while rollout completes.