CVE-2020-28884: OS Command Injection
First published: Fri Jan 28 2022(Updated: )
** DISPUTED ** Liferay Portal Server tested on 7.3.5 GA6, 7.2.0 GA1 is affected by OS Command Injection. An administrator user can inject Groovy script to execute any OS command on the Liferay Portal Sever. NOTE: The developer disputes this as a vulnerability since it is a feature for administrators to run groovy scripts and therefore not a design flaw.
Credit: cve@mitre.org cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Liferay Liferay Portal | =7.2-ga1 | |
| Liferay Liferay Portal | =7.3.5-ga6 | |
| =7.2-ga1 | ||
| =7.3.5-ga6 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://learn.liferay.com/dxp/latest/en/system-administration/using-the-script-engine/running-scripts-from-the-script-console.html
- https://medium.com/@tranpdanh/some-way-to-execute-os-command-in-liferay-portal-84498bde18d3
- https://medium.com/%40tranpdanh/some-way-to-execute-os-command-in-liferay-portal-84498bde18d3
- collector/nvd-index
- agent/weakness
- agent/type
- agent/first-publish-date
- agent/author
- agent/severity
- agent/references
- agent/status
- agent/softwarecombine
- agent/description
- agent/event
- agent/tags
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/last-modified-date
- collector/mitre-cve
- source/MITRE
- status/disputed
- vendor/liferay
- canonical/liferay liferay portal
- version/liferay liferay portal/7.2-ga1
- version/liferay liferay portal/7.3.5-ga6