CVE-2020-28884: Command Injection

Published Jan 28, 2022

Updated

DISPUTED Liferay Portal Server tested on 7.3.5 GA6, 7.2.0 GA1 is affected by OS Command Injection. An administrator user can inject Groovy script to execute any OS command on the Liferay Portal Sever. NOTE: The developer disputes this as a vulnerability since it is a feature for administrators to run groovy scripts and therefore not a design flaw.

Affected Software

2 affected components

Liferay Liferay Portal=7.2-ga1

Liferay Liferay Portal=7.3.5-ga6

Event History

Jan 28, 2022

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Disputed

12:15 PM

Frequently Asked Questions

What is the severity of CVE-2020-28884?

CVE-2020-28884 is considered disputed by the developers, as it is described as a feature rather than a vulnerability.

How do I fix CVE-2020-28884?

Since CVE-2020-28884 is regarded as a feature, official remediation steps have not been provided.

Who is affected by CVE-2020-28884?

CVE-2020-28884 affects users of Liferay Portal versions 7.2.0 GA1 and 7.3.5 GA6.

Can CVE-2020-28884 lead to a security breach?

Yes, if exploited by an unauthorized user, CVE-2020-28884 could allow execution of arbitrary OS commands, potentially leading to a security breach.

What types of systems are vulnerable to CVE-2020-28884?

CVE-2020-28884 affects Liferay Portal Server installations where administrators can execute Groovy scripts, potentially allowing OS command injection.