Sandeep Giri has reported multiple vulnerabilities in Liferay Enterprise Portal, which can be exploited by malicious users to conduct script insertion attacks.

The vulnerabilities are caused due to missing validation of input supplied in various fields (e.g. the "Subject" field of messages posted on the message board). This can be exploited to execute arbitrary HTML and script code in another user's browser session in context of an affected site when malicious information is viewed.

Solution
The vulnerabilities have reportedly been fixed in version 2.2.0.

Provided and/or discovered by
Sandeep Giri

Changelog
Further details available to Secunia VIM customers

Deep Links
Links available to Secunia VIM customers