CVE-2021-33990: OS Command Injection
First published: Sun Apr 16 2023(Updated: )
** DISPUTED ** Liferay Portal 6.2.5 allows Command=FileUpload&Type=File&CurrentFolder=/ requests when frmfolders.html exists. NOTE: The vendor disputes this issue because the exploit reference link only shows frmfolders.html is accessible and does not demonstrate how an unauthorized user can upload a file.
Credit: cve@mitre.org cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Liferay Liferay Portal | =6.2.5 | |
| =6.2.5 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2021-33990.
What is the severity of CVE-2021-33990?
The severity of CVE-2021-33990 is critical with a severity value of 9.8.
Which version of Liferay Portal is affected by CVE-2021-33990?
Liferay Portal version 6.2.5 is affected by CVE-2021-33990.
What is the CWE ID for CVE-2021-33990?
The CWE ID for CVE-2021-33990 is CWE-281.
Are there any known exploit references for CVE-2021-33990?
Yes, there are exploit references available for CVE-2021-33990. You can find them at the following links: [http://packetstormsecurity.com/files/171701/Liferay-Portal-6.2.5-Insecure-Permissions.html](http://packetstormsecurity.com/files/171701/Liferay-Portal-6.2.5-Insecure-Permissions.html) and [https://github.com/fu2x2000/Liferay_exploit_Poc](https://github.com/fu2x2000/Liferay_exploit_Poc).
- collector/nvd-index
- agent/references
- agent/type
- agent/author
- agent/severity
- agent/weakness
- agent/status
- agent/softwarecombine
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/tags
- agent/event
- agent/first-publish-date
- agent/last-modified-date
- collector/nvd-api
- source/NVD
- status/disputed
- vendor/liferay
- canonical/liferay liferay portal
- version/liferay liferay portal/6.2.5