CVE-2021-47903: LiteSpeed Web Server Enterprise 5.4.11 - Command Injection
LiteSpeed Web Server Enterprise 5.4.11 contains an authenticated command injection vulnerability in the external app configuration interface. Authenticated administrators can inject shell commands through the 'Command' parameter in the server configuration, allowing remote code execution via path traversal and bash command injection.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
LiteSpeed Web Server Enterpriseto a version that resolves this vulnerability.Fixed in 5.4.11 - Compensating control
Restrict access to LiteSpeed Web Server Enterprise external app configuration interface so only trusted users/admins can reach the interface that accepts the 'Command' parameter.
Event History
Frequently Asked Questions
What is the severity of CVE-2021-47903?
CVE-2021-47903 has been assigned a high severity rating due to its potential for command injection that affects authenticated administrators.
How do I fix CVE-2021-47903?
To mitigate CVE-2021-47903, upgrade LiteSpeed Web Server Enterprise to a patched version or restrict access to the external app configuration interface.
Who is affected by CVE-2021-47903?
CVE-2021-47903 affects authenticated administrators using LiteSpeed Web Server Enterprise version 5.4.11.
What type of vulnerability is CVE-2021-47903?
CVE-2021-47903 is a command injection vulnerability that allows attackers to execute arbitrary commands on the server.
Can CVE-2021-47903 be exploited remotely?
CVE-2021-47903 requires local authentication, so it cannot be exploited remotely without valid administrator credentials.