Cross-site scripting (XSS) vulnerability in the Admin portlet in Liferay Portal 4.3.6 allows remote authenticated users to inject arbitrary web script or HTML via the Shutdown message.

More... (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-0181)