CVE-2019-11444: OS Command Injection
DISPUTED An issue was discovered in Liferay Portal CE 7.1.2 GA3. An attacker can use Liferay's Groovy script console to execute OS commands. Commands can be executed via a [command].execute() call, as demonstrated by "def cmd =" in the ServerAdminPortletscript value to group/controlpanel/manage. Valid credentials for an application administrator user account are required. NOTE: The developer disputes this as a vulnerability since it is a feature for administrators to run groovy scripts and therefore not a design flaw.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2019-11444?
CVE-2019-11444 is disputed, but it relates to potential remote command execution vulnerabilities that can be exploited by attackers.
How does CVE-2019-11444 allow execution of OS commands?
CVE-2019-11444 allows execution of OS commands through Liferay's Groovy script console using the [command].execute() method.
What version of Liferay Portal is affected by CVE-2019-11444?
CVE-2019-11444 specifically affects Liferay Portal CE version 7.1.2 GA3.
Can I exploit CVE-2019-11444 if I have access to the Groovy script console?
Yes, if an attacker has access to the Groovy script console in Liferay Portal CE 7.1.2 GA3, they can potentially exploit CVE-2019-11444 to execute commands.
How can I mitigate the risks associated with CVE-2019-11444?
To mitigate the risks of CVE-2019-11444, it is recommended to restrict access to the Groovy script console and upgrade to a patched version of Liferay Portal.