CVE-2020-28885: OS Command Injection
First published: Fri Jan 28 2022(Updated: )
** DISPUTED ** Liferay Portal Server tested on 7.3.5 GA6, 7.2.0 GA1 is affected by OS Command Injection. An administrator user can inject commands through the Gogo Shell module to execute any OS command on the Liferay Portal Sever. NOTE: The developer disputes this as a vulnerability since it is a feature for administrators to access and execute commands in Gogo Shell and therefore not a design flaw
Credit: cve@mitre.org cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Liferay Liferay Portal | =7.2-ga1 | |
| Liferay Liferay Portal | =7.3.5-ga6 | |
| =7.2-ga1 | ||
| =7.3.5-ga6 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- collector/nvd-index
- agent/weakness
- agent/type
- agent/first-publish-date
- agent/severity
- agent/references
- agent/author
- agent/softwarecombine
- agent/status
- agent/description
- agent/event
- agent/tags
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/last-modified-date
- collector/mitre-cve
- source/MITRE
- status/disputed
- vendor/liferay
- canonical/liferay liferay portal
- version/liferay liferay portal/7.2-ga1
- version/liferay liferay portal/7.3.5-ga6