CVE-2020-28885: Command Injection

Published Jan 28, 2022

Updated

DISPUTED Liferay Portal Server tested on 7.3.5 GA6, 7.2.0 GA1 is affected by OS Command Injection. An administrator user can inject commands through the Gogo Shell module to execute any OS command on the Liferay Portal Sever. NOTE: The developer disputes this as a vulnerability since it is a feature for administrators to access and execute commands in Gogo Shell and therefore not a design flaw

Affected Software

2 affected components

Liferay Liferay Portal=7.2-ga1

Liferay Liferay Portal=7.3.5-ga6

Event History

Jan 28, 2022

CVE Published

via MITRE·11:17 AM

Data Sourced

via MITRE·11:17 AM

Description

Disputed

12:15 PM

Frequently Asked Questions

What is the severity of CVE-2020-28885?

CVE-2020-28885 is considered a potential security risk due to OS command injection vulnerabilities in Liferay Portal.

How do I fix CVE-2020-28885?

Fixing CVE-2020-28885 involves updating to the latest version of Liferay Portal that addresses this vulnerability.

Who is affected by CVE-2020-28885?

Administrators using Liferay Portal versions 7.2.0 GA1 and 7.3.5 GA6 are affected by CVE-2020-28885.

What type of vulnerability is CVE-2020-28885?

CVE-2020-28885 is classified as an OS Command Injection vulnerability.

Can CVE-2020-28885 be exploited remotely?

CVE-2020-28885 can potentially be exploited remotely if an attacker has access to the Gogo Shell module as an administrator.