CVE-2021-29053: SQL Injection
Multiple SQL injection vulnerabilities in Liferay Portal 7.3.5 and Liferay DXP 7.3 before fix pack 1 allow remote authenticated users to execute arbitrary SQL commands via the classPKField parameter to (1) CommerceChannelRelFinder.countByCC, or (2) CommerceChannelRelFinder.findByCC.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/com.liferay.portal:release.dxp.bomto a version that resolves this vulnerability.Fixed in 7.3.10.fp1 - Upgrade
Upgrade
maven/com.liferay.portal:release.portal.bomto a version that resolves this vulnerability.Fixed in 7.3.6 - Upgrade
Upgrade
Liferay Portal 7.3.5 / Liferay DXP 7.3to a version that resolves this vulnerability.Patch fix pack 1 - Compensating control
Restrict access so that remote authenticated users cannot reach the functionality that uses the classPKField parameter (e.g., limit exposure to trusted users/roles and reduce authenticated access paths) until fix pack 1 is applied.
Event History
Frequently Asked Questions
What is CVE-2021-29053?
CVE-2021-29053 is a vulnerability in Liferay Portal 7.3.5 and Liferay DXP 7.3 that allows remote authenticated users to execute arbitrary SQL commands.
How does CVE-2021-29053 affect Liferay Portal and Liferay DXP?
CVE-2021-29053 allows remote authenticated users to execute arbitrary SQL commands through certain parameters in Liferay Portal 7.3.5 and Liferay DXP 7.3.
What is the severity of CVE-2021-29053?
CVE-2021-29053 has a severity rating of 8.8 (high).
How can I fix CVE-2021-29053?
To fix CVE-2021-29053, it is recommended to apply the relevant fix pack for Liferay Portal 7.3 or Liferay DXP 7.3.
Is there any additional information available about CVE-2021-29053?
Additional information about CVE-2021-29053 can be found on the official Liferay website and the Liferay Portal known vulnerabilities page.